GeoVision GeoWebPlayer exposes a websocket server that accepts commands originating from local hosts. Several commands include an integer "index" parameter that is used to index internal arrays without bounds checking. This omission creates an out‑of‑bounds read condition (CWE‑129). A crafted command that abuses this flaw could read memory beyond the intended array boundaries, potentially exposing sensitive data stored adjacent to the accessed region. Based on the description, it is inferred that an attacker could read memory beyond the intended array boundaries and potentially expose sensitive data stored adjacent to the accessed region, such as confidential configuration or operational information.

Affected are GeoVision Inc. GeoWebPlayer versions earlier than 1.1.3.0, notably the 1.1.1.0 releases for both 64‑bit and Windows platforms. The vendor has released GeoWebPlayer V1.1.3.0 that contains the fix. Upgrading to this patched version removes the vulnerability.

The CVSS score of 8.3 indicates a high‑severity weakness. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require local or locally trusted network access to the websocket interface to send malformed commands that trigger the out‑of‑bounds reads. No arbitrary code execution, privilege escalation, or denial of service is implied or supported by the description.