CVE-2011-2954: Realnetworks Realplayer

High severity, CVSS 9.3. EPSS: 3.7% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the AutoUpdate feature in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products

• Realnetworks Realplayer: version 11.0 only; version 11.1 only; version 14.0.0 only; version 14.0.1 only; version 14.0.2 only; version 14.0.3 only; …
• Realnetworks Realplayer SP: version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.5 only; version 1.1 only; version 1.1.1 only; …

Published 2011-08-18. Last modified 2026-06-16.