RealNetworks RealPlayer VIDOBJ_START_CODE Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a target must visit a malicious page or open a malicious file. The flaw exists within dmp4.dll, specifically the decoding of an MPEG stream. When encountering a VIDOBJ_START_CODE object the process inproperly validates the size of the destination buffer used for rendering. The contents of a decoded frame are copied to this region which can result in heap corruption if the decoded frame size exceeds the size of this region. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the process.