CVE-2008-1309
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer...
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.
Exploit likelihood
What each source reports
NVD Score used
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.
- Record
CVE-2008-1309- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.
- Record
CVE-2008-1309- Updated
- 2026-11-02
EUVDEUVD-2008-1316 No score
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.
- Record
EUVD-2008-1316- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g64h-446x-5j6x No score
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer...
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.
- Record
GHSA-g64h-446x-5j6x- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | RealPlayer - 'rmoc3260.dll' ActiveX Control Heap Corruption (Metasploit) | 2010-06-15 |
| Exploit-DB | Real Player - 'rmoc3260.dll' ActiveX Control Remote Code Execution | 2008-04-01 |
| Metasploit | RealPlayer rmoc3260.dll ActiveX Control Heap Corruption | 2008-03-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1309 is a high vulnerability (CVSS 9.3) in Realnetworks Realplayer, published March 12, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 46.0%, the 98th percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/41087
vupen.com/english/advisories/2008/2194/references
service.real.com/realplayer/security/07252008_player/en
secunia.com/advisories/29315
lists.grok.org.uk/pipermail/full-disclosure/2008-March/060659.html
securitytracker.com/id?1019576
Show 9 moreShow less
exploit-db.com/exploits/5332
zerodayinitiative.com/advisories/ZDI-08-047
kb.cert.org/vuls/id/831457
securityfocus.com/archive/1/494779/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2008-1309
github.com/advisories/GHSA-g64h-446x-5j6x