GeoVision GeoWebPlayer implements a websocket server that accepts commands originating from localhost or networked clients. Several commands include an integer "index" parameter that is used to access internal arrays without bounds checking. This omission creates an out-of-bounds read (CWE-129). An attacker who can send a malformed command with a crafted index value can read memory beyond the intended array boundaries, potentially exposing sensitive data such as configuration information or other operational secrets that reside adjacent to the accessed memory region.

Affected are GeoVision Inc.’s GeoWebPlayer instances running versions earlier than 1.1.3.0, notably the 1.1.1.0 releases for both 64‑bit Windows and Windows platforms. The vendor has released GeoWebPlayer V1.1.3.0 that contains the fix. Upgrading to this patched version removes the vulnerability.

The CVSS score of 8.3 indicates a high severity weakness. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require local or locally trusted network access to the websocket interface to send malformed commands that trigger the out‑of‑bounds reads. No arbitrary code execution, privilege escalation, or denial of service is implied or supported by the description.