Nero's vulnerability profile centers on a narrowly scoped portfolio of media and backup applications—including MediaHome, BackItUp, and MediaPlayer—that operate across consumer and small-business storage and playback workflows. The recurring weakness classes, including improper input validation, buffer-boundary violations, and path-traversal flaws, are characteristic of file-processing and media-parsing codebases; these vulnerabilities frequently acquire public exploit code. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nero over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-0619HIGH Buffer overflow in NeroMediaPlayer.exe in Nero Media Player 1.4.0.35 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (persistent crash) v | Feb 6, 2008 | 9.3 | 41 | NO | YES |
CVE-2008-7079HIGH Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long entry in a .M3U playlist file. | Aug 25, 2009 | 9.3 | 35 | NO | YES |
CVE-2012-5877MEDIUM Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an HTTP header without a name. | May 30, 2014 | 5.0 | 31 | NO | YES |
CVE-2012-5876MEDIUM Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to cause a denial of service (crash) via a long string in the (1 | May 30, 2014 | 5.0 | 29 | NO | YES |
CVE-2025-63680HIGH Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExecuteW fallback extension resolution, lead | Nov 14, 2025 | 8.6 | 27 | NO | NO |
CVE-2017-15383HIGH Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, exploitable via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\Nero directory. | Oct 16, 2017 | 7.8 | 24 | NO | NO |
CVE-2007-2322HIGH NMMediaServer.exe in Nero MediaHome 2.5.5.0 and CE 1.3.0.4 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted packet that c | Apr 27, 2007 | 7.8 | 21 | NO | NO |
CVE-2008-1905MEDIUM NMMediaServer.exe in Nero MediaHome 3.3.3.0 and earlier, as used in Nero 8.3.2.1 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and app | Apr 22, 2008 | 5.0 | 15 | NO | NO |
CVE-2005-3484MEDIUM Directory traversal vulnerability in NeroNET 1.2.0.2 and earlier allows remote attackers to read arbitrary files with certain file extensions (such as ZIP, AVI, JPG, TXT, and HTML) | Nov 3, 2005 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nero.
Media articles that mention a CVE ID that affects a product developed by Nero — matched by CVE ID, not by vendor name.