CVE-2010-0416: Realnetworks Helix Player

High severity, CVSS 7.5. EPSS: 11.3% chance of exploitation in the next 30 days.

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a URL argument containing a % (percent) character that is not followed by two hex digits.

Affected products

• Realnetworks Helix Player: version 1.0.6 only
• Realnetworks Realplayer: any version

Published 2010-02-18. Last modified 2026-06-16.