CVE-2003-0141
Status: ModifiedMedium (5.1)—
The PNG deflate algorithm in RealOne Player 6.0.11.x and earlier, RealPlayer 8/RealPlayer Plus 8 6.0.9.584, and other versions allows remote attackers to corrupt the heap and overwrite arbitrary memory via a PNG graphic file format containing compressed data using fixed trees that contain the length values 286-287, which are treated as a very large length.
CVSS
- Version: 2.0
- Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
- Base score: 5.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.96%
- Percentile among all scored CVEs: 87
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (3)
CWEs
- NVD-CWE-Other
References
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0156.html
- http://marc.info/?l=bugtraq&m=104887465427579&w=2
- http://www.coresecurity.com/common/showdoc.php?idx=311&idxseccion=10
- http://www.kb.cert.org/vuls/id/705761
- http://www.securityfocus.com/bid/7177
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0156.html
- http://marc.info/?l=bugtraq&m=104887465427579&w=2
- http://www.coresecurity.com/common/showdoc.php?idx=311&idxseccion=10
- http://www.kb.cert.org/vuls/id/705761
- http://www.securityfocus.com/bid/7177
Raw JSON (NVD)
Show
{
"id": "CVE-2003-0141",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5.1,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "HIGH",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 4.9,
"obtainUserPrivilege": true,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2003-04-02T05:00:00.000",
"references": [
{
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0156.html",
"source": "cve@mitre.org"
},
{
"url": "http://marc.info/?l=bugtraq&m=104887465427579&w=2",
"source": "cve@mitre.org"
},
{
"url": "http://www.coresecurity.com/common/showdoc.php?idx=311&idxseccion=10",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.kb.cert.org/vuls/id/705761",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/7177",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0156.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://marc.info/?l=bugtraq&m=104887465427579&w=2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.coresecurity.com/common/showdoc.php?idx=311&idxseccion=10",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.kb.cert.org/vuls/id/705761",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/7177",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The PNG deflate algorithm in RealOne Player 6.0.11.x and earlier, RealPlayer 8/RealPlayer Plus 8 6.0.9.584, and other versions allows remote attackers to corrupt the heap and overwrite arbitrary memory via a PNG graphic file format containing compressed data using fixed trees that contain the length values 286-287, which are treated as a very large length."
}
],
"lastModified": "2026-06-16T22:01:37.943",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realone_enterprise_desktop:6.0.11.774:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27DDB6F2-9EAF-4A77-BB3B-D3989E1D9458"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF6535A6-6647-4E60-B5AA-24DFC06360AE"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:6.0.10.505:gold:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BBC41FB-B9F5-47EB-97D8-3ACFC5182AAE"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:6.0.11.818:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C6BB6A9-B0CE-4C04-8481-53B7CB195264"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:6.0.11.830:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "41688192-70B7-4C35-AE4F-FE116104137A"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:6.0.11.841:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA11D9CD-113B-4977-B150-D6500552222A"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:6.0.11.853:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF391DD1-2912-49BF-BC9F-B9FA3771737F"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:9.0.0.288:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6083AD8-024A-41C7-8189-BE0827239090"
},
{
"criteria": "cpe:2.3:a:realnetworks:realone_player:9.0.0.297:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "103892C8-6C98-4861-8252-0076EF1B1302"
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E6051B4-1B15-44C0-B2CD-5504E68C60F2"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}