Executive brief
RealTimes Desktop Service, a component of the RealPlayer media suite, contains a configuration flaw that could allow a local user to gain full administrative control over a Windows computer. By placing a specially named file in a specific folder, an attacker can trick the system into running their malicious code with high-level system privileges when the computer restarts. This could lead to a complete compromise of the machine, including the ability to access all user data and install persistent malware.
Technical details
RealTimes Desktop Service (rpdsvc.exe) version 18.1.4 and earlier is vulnerable to an unquoted service path (CWE-428). The service path for 'rpdsvc.exe' is stored without quotation marks (e.g., c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe), which allows a local attacker with write permissions to a parent directory to intercept the service execution. By placing a malicious executable in a path such as 'C:\program.exe', the Windows Service Control Manager will execute the attacker's file instead of the intended binary during system boot or service restart. Successful exploitation grants the attacker arbitrary code execution with LocalSystem privileges.
Affected products
- RealNetworks RealTimes Desktop Service 18.1.4 and earlier
Timeline
- 2020-11-07: disclosed: Vulnerability discovered by Erick Galindo
- 2020-11-09: other: Exploit code published to Exploit-DB
- 2026-06-19: advisory: NVD and VulnCheck advisory published