CVE-2011-2949: Realnetworks Realplayer

High severity, CVSS 9.3. EPSS: 5% chance of exploitation in the next 30 days.

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via crafted ID3v2 tags in an MP3 file.

Affected products

• Realnetworks Realplayer: version 11.0 only; version 11.1 only; version 14.0.0 only; version 14.0.1 only; version 14.0.2 only; version 14.0.3 only; …
• Realnetworks Realplayer SP: version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.5 only; version 1.1 only; version 1.1.1 only; …

Published 2011-08-18. Last modified 2026-06-16.