The vulnerability appears in GeoWebPlayer, an addon for GeoVision software that runs a WebSocket server. The server accepts commands from the local system and many commands use an `index` parameter to access internal arrays. Because the index value is not validated against the bounds of these arrays, an attacker can trigger an out-of-bounds read, causing the process to expose arbitrary contents from its memory. This flaw, identified as CWE‑129, does not result in code execution or privilege escalation but can leak sensitive data and compromise confidentiality.

The affected product is GeoVision Inc.’s GeoWebPlayer addon, version 1.1.1.0 (both 64‑bit and Windows builds). A vendor patch is available as GeoWebPlayer V1.1.3.0, which addresses the flaw.

The CVSS score of 8.3 indicates high severity, while the EPSS score of < 1 % suggests a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is local, requiring access to the device’s loopback interface to send malicious WebSocket commands that contain out-of-range indexes. An attacker can read arbitrary memory but cannot directly exfiltrate data or gain code execution without additional vulnerability exploitation.