GeoWebPlayer provides a websocket server that accepts commands from the local host. Several commands, such as setStream, take an index parameter that is used to access internal arrays without bounds checking, allowing an attacker to read memory beyond the intended buffer. This out-of-bounds read can expose sensitive configuration data or other confidential information, constituting an information‑disclosure flaw classified as CWE‑129.

The vulnerability affects GeoVision Inc.’s GeoWebPlayer addon version 1.1.1.0 and earlier releases on Windows and 64-bit platforms. The vendor has released a patch in GeoWebPlayer v1.1.3.0 that mitigates the issue. Systems running any unpatched build of GeoWebPlayer are vulnerable.

The CVSS score of 8.3 reflects a high severity with significant impact on confidentiality. The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploit at the time of evaluation. Based on the description, it is inferred that the likely attack vector is local, as the websocket server accepts connections from localhost; however, if the server is exposed beyond the local host, remote exploitation could also be possible. Exploitation requires the ability to send crafted websocket messages that include an out-of-bounds index, which then triggers the memory read.