CVE-2022-32270

PoC ×2—

CVSS 3.1

9.8 critical

EPSS

5%p91

Published

Jun 3, 2022 (Jun 3, 2022)

Modified

Jun 17, 2026

Description

In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).

Vendors: realnetworks
Products: realplayer
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.5%)

In the news0 stories

No ingested article mentions this CVE yet.