FFmpeg before 0.5.4 as used in MPlayer and other products allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a malformed RealMedia file.