CVE-2007-3410

Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp...

9.3 HighPublic exploitFix available

Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and possibly 10.5, RealOne Player, RealPlayer Enterprise, and Helix Player 10.5-GOLD and 10.0.5 through 10.0.8, allows remote attackers to execute arbitrary code via an SMIL (SMIL2) file with a long wallclock value.

Exploit likelihood

36.1%Up 2.9 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2007-3410
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-3410
Updated: 2026-11-02

EUVDEUVD-2007-3396 No score

Record: EUVD-2007-3396
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7hxv-5pvm-4mww No score

Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp...

Record: GHSA-7hxv-5pvm-4mww
Weakness: CWE-119
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`HelixPlayer` Red Hat:enterprise_linux:4::as	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`HelixPlayer-debuginfo` Red Hat:enterprise_linux:4::as	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`HelixPlayer` Red Hat:enterprise_linux:4::desktop	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`HelixPlayer-debuginfo` Red Hat:enterprise_linux:4::desktop	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`HelixPlayer` Red Hat:enterprise_linux:4::es	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`HelixPlayer-debuginfo` Red Hat:enterprise_linux:4::es	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`HelixPlayer` Red Hat:enterprise_linux:4::ws	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`HelixPlayer-debuginfo` Red Hat:enterprise_linux:4::ws	before 1:1.0.6-0.EL4.2	1:1.0.6-0.EL4.2
`realplayer` Red Hat:rhel_extras:3 From an advisory covering 4 CVEs	before 0:10.0.9-0.rhel3.4	0:10.0.9-0.rhel3.4
`RealPlayer` Red Hat:rhel_extras:5::client From an advisory covering 4 CVEs	before 0:10.0.9-3.el5	0:10.0.9-3.el5
`RealPlayer-debuginfo` Red Hat:rhel_extras:5::client From an advisory covering 4 CVEs	before 0:10.0.9-3.el5	0:10.0.9-3.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	RealNetworks RealPlayer/HelixPlayer - SMIL wallclock Stack Overflow (PoC)	2007-06-27

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, exploits, facts, references, title	Exploit-DB, GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-3410 is a high vulnerability (CVSS 9.3) in Realnetworks Helix Player, published June 26, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 36.1%, the 98th percentile. Fixed in HelixPlayer 1:1.0.6-0.EL4.2.

References

Show 38 moreShow less