GeoWebPlayer supplies a websocket server that accepts commands from localhost. Several commands use an "index" argument to access internal arrays but the index is never validated for range. An attacker can therefore send a crafted command with an out-of-range value, which will read data outside the intended array bounds. The read may expose memory that contains sensitive information or lead to abnormal application behavior, potentially causing a crash.

The vulnerability affects GeoVision Inc.’s GeoWebPlayer 1.1.1.0, which is used with GV‑VMS, and runs on Windows and 64‑bit systems. The issue has been fixed in GeoWebPlayer 1.1.3.0, which adds bounds checking for the index parameter.

The CVSS score of 8.3 reflects a high severity flaw. The EPSS score of < 1% and the lack of listing in the CISA KEV catalog suggest a low likelihood of current exploitation. The websocket server listens only on local code process to send malicious frames. If successfully exploited, the out-of-bounds read could leak confidential memory contents or destabilize the application, but the precise impact depends on what data is accessed.