CVE-2020-37251: RealTimes Desktop Service 18.1.4 Unquoted Service Path Privilege Escalation

Published Jun 19, 2026

Updated

RealTimes Desktop Service 18.1.4 contains an unquoted service path vulnerability in the rpdsvc.exe binary that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories to execute arbitrary code with LocalSystem privileges during service startup or system reboot.

Affected Software

1 affected component

RealNetworks RealTimes Desktop Service=18.1.4

Event History

Jun 19, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-37251?

CVE-2020-37251 has a severity rating of 8.5, indicating high risk.

How can I fix CVE-2020-37251?

To fix CVE-2020-37251, ensure that the service path for rpdsvc.exe is correctly quoted to prevent privilege escalation.

Who is affected by CVE-2020-37251?

CVE-2020-37251 affects users of RealTimes Desktop Service version 18.1.4.

What type of vulnerability is CVE-2020-37251?

CVE-2020-37251 is an unquoted service path vulnerability that allows local privilege escalation.

Can CVE-2020-37251 be exploited remotely?

CVE-2020-37251 cannot be exploited remotely as it requires local access to the system.