The GeoWebPlayer Websocket server accepts a variety of commands from local sources, many of which use an index value to access internal arrays. Because the server does not validate that index against array bounds, an attacker can send a crafted command that causes the server to read memory beyond the intended array boundaries. This out‑of‑bounds read permits the disclosure of sensitive internal data but does not allow the attacker to write to memory or execute code. The flaw maps to CWE‑129: Improper Validation of Array Index.

GeoVision Inc. GeoWebPlayer versions 1.1.1.0 on both 64‑bit and Windows platforms are affected. The bounds‑checking patch was released in GeoWebPlayer v1.1.3.0, which is the recommended upgrade path for all supported platforms.

The CVSS base score of 8.3 signals a high‑severity vulnerability. The EPSS score of less than 1% indicates that the probability of exploitation at this time is low. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or network access that can reach the WebSocket endpoint; an attacker would need to supply a crafted command with an invalid index to trigger the out‑of‑bounds read. The impact is limited to information disclosure; it does not confer code execution or persistence.