The vulnerability resides in the GeoWebPlayer WebSocket server, which processes commands from local clients. Each command includes an index that selects elements of internal arrays. Because the server does not validate that the index is within the bounds of the array, an attacker can supply an out‑of‑range value. The server will then read memory beyond the intended array boundaries, which can leak sensitive internal data. This flaw is an instance of CWE‑129 and can lead to a disclosure of information contained in memory that is not otherwise exposed. The precise nature of the leaked data is not enumerated in the advisory, but it could include configuration values, application state, or other confidential material.

GeoVision Inc. GeoWebPlayer versions 1.1.1.0 for 64‑bit and Windows platforms are affected. The vendors released a patch in GeoWebPlayer 1.1.3.0 that adds bounds checks for the index parameter. All current builds of the application should be updated to this or newer revisions to eliminate the vulnerability.

The base CVSS score of 8.3 denotes a high‑severity flaw, and the EPSS score of less than 1% indicates that public exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Because the WebSocket interface is exposed only to localhost, the attack requires local access or a means of gaining local entry. An attacker who can submit crafted commands can trigger the out‑of‑bounds read and potentially gain access to sensitive data, but the advisory does not document any escalation to code execution or persistent compromise. Organizations should treat the exposure of internal data as a threat to confidentiality.