The Geo creates a websocket server that listens for commands originating from the host machine. Several of these commands include an "index" parameter that is used unchecked to access internal arrays. Because the index is not validated, an attacker can supply values that reference memory outside the intended bounds, leading to an out-of-bounds read (CWE-129) and allows local attackers to read sensitive information, but it does not provide code execution.

GeoVision Inc.'s GeoWebPlayer add‑on is affected in all versions before the patch, notably 1.1.1.0. The vulnerability exists on both 64‑bit and Windows platforms. The vendor released a fix in GeoWebPlayer V1.1.3.0, which includes bounds checking for the index parameter.

The CVSS score of 8.3 indicates a high severity. The EPSS value of less than 1% shows a very low but nonzero probability of exploitation, and the issue is not listed in CISA's KEV catalog. Based on the description, the attack vector is local, requiring the ability to send commands to the websocket server. An attacker with local privileges could trigger the read of arbitrary memory, potentially exposing sensitive data, but no publicly exploit has been documented.