Reported October 01, 2004, by eEye Digital Security
A vulnerability in RealPlayer could let a remote attacker reliably overwrite heap memory with arbitrary data and execute arbitrary code within the user security context. This specific flaw exists within the pnen3260.dll file that RealPlayer uses. By specially crafting a malformed .rm movie file along with a Synchronized Multimedia Integration Language (SMIL) file, a direct heap overwrite is triggered and reliable code execution is then possible.
RealNetworks has released has released a patch for this vulnerability, which is also available via the Updates section of the affected application.
Discovered by eEye Digital Security.