GeoWebPlayer hosts a WebSocket server that accepts localhost commands, many of which include an `index` parameter that is used to access internal arrays. Because the value is not validated against bounds, an attacker can trigger an out‑of‑bounds read, exposing arbitrary contents from the process memory. The flaw is a classic example of CWE‑129 and does not provide an escape to remote code execution or privilege escalation, but it can leak sensitive data and compromise confidentiality.

Geovision Inc.’s GeoWebPlayer addon, version 1.1.1.0 on both 64‑bit and Windows platforms, is affected. The vendor has released GeoWebPlayer V1.1.3.0, which implements bounds checking for the vulnerable commands.

The CVSS score of 8.3 denotes high severity, while the EPSS score of < 1% indicates an extremely low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is local access to the device via the loopback interface; an attacker can read arbitrary memory but cannot directly achieve code execution or privilege escalation.