CVE-2022-32270: Realnetworks Realplayer

Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days.

In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).

Affected products

• Realnetworks Realplayer: version 20.0.7.309 only; version 20.0.8.310 only

Published 2022-06-03. Last modified 2026-06-17.