8.7

CVE-2011-10028: RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution

Deferred
Published 20-08-2025Last modified 15-05-2026

Vulnerability summary

CVE-2011-10028 is a high (CVSS 8.7) vulnerability in realnetworks realarcade activex. EPSS estimates a 1.64% chance of exploitation in the next 30 days, higher than 76.4% of scored vulnerabilities. 4 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 09-04-2011)

Source freshness unavailable

How is this decided?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
1.64%
0%100%
Low · +0.50 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits4exploit-database, reference, metasploit

Timeline

  1. 20-08-2025
    PublishedVulnerability first disclosed.
  2. 15-05-2026
    Last modifiedVulnerability information updated.

Description

The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim's Windows machine without proper validation or restrictions. This platform was sometimes referred to or otherwise known as RealArcade or Arcade Games and has since consolidated with RealNetworks' platform, GameHouse.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

1.64%

Chance of exploitation in the next 30 days

Percentile

76%

Versus all other CVEs

30-day change

Increase +0.50 pp

From 1.14% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

4 found
  • exploit-databaseremotewindowsVerified

    RealNetworks RealGames StubbyUtil.ProcessMgr.1 - ActiveX Control Multiple Remote Command Executions

    Maturity: weaponized

  • exploit-databaseremotewindowsVerified

    Real Networks Arcade Games - StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution (Metasploit)

    Maturity: weaponized

  • referenceUnverified

    Exploit Reference (raw.githubusercontent.com)

    Maturity: unknown

Show all 4 exploits
  • MetasploitMetasploitremoteUnverified

    Real Networks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution

    exploit/windows/browser/real_arcade_installerdlg

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Realnetworks1 product

1 vendor · 1 product

References

7 links