CVE-2011-2948: Realnetworks Realplayer

High severity, CVSS 9.3. EPSS: 4.3% chance of exploitation in the next 30 days.

RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.0 through 2.1.5, and Mac RealPlayer 12.0.0.1569 do not properly handle DEFINEFONT fields in SWF files, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted file.

Affected products

• Realnetworks Realplayer: version 11.0 only; version 11.1 only; version 14.0.0 only; version 14.0.1 only; version 14.0.2 only; version 14.0.3 only; …
• Realnetworks Realplayer SP: version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.5 only; version 1.1 only; version 1.1.1 only; …

Published 2011-08-18. Last modified 2026-06-16.