Description
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.


### saveVideo command index-out-of-bound

When sending the `saveVideo` command, the `index` field is extracted from the websocket message [1]. Then without checking the range of the index, it is used to trigger a CriticalSection ([2]) and releases it [3]. The release function call ([3]) is executed using a function pointer which will be read out of bounds potentially leading to code execution:





v6 = get_entry(a2, "index");

result = json_is_value_int(v6);

if ( (_BYTE)result )

{

v8 = get_entry(a2, "index");

index = json_value_to_int(&v8->value); // [1]

result = CCriticalSection::EnterCritSection(&this->crit_sections[index]); //[2]

if ( result )

{

if ( this->array_of_IPCams[index] )

{

if ( this->array_of_IPCams[index]->field_20 )

do_PostMessageA((CViewer *)this->array_of_IPCams[index], 0x111u, 0x139Fu, v11);

}

return (*(int (__thiscall **)(CCriticalSection *))(this->crit_sections[index].vtbl + 20))(&this->crit_sections[index]); //[3]

}

}
Published: 2026-07-02
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

GeoWebPlayer contains a WebSocket server that accepts local control commands. Based on the description, it is inferred that the attacker must have the ability to send WebSocket messages, which typically requires local process access on the target host. Several commands, including saveVideo, use an index parameter to address internal arrays without bounds checking. An attacker with local process on the same machine can send a malicious WebSocket message containing an out‑of‑range index, triggering an out‑of‑bounds read of a function pointer and leading to arbitrary code execution. The flaw is an input validation weakness (CWE‑129) and threatens confidentiality and integrity of the host system.

Affected Systems

The vulnerability affects GeoVision Inc GeoWebPlayer version 1.1.1.0, which is distributed with GeoVision VMS, GV-Cloud, and similar products. Any deployment that includes the GeoWebPlayer addon and has not updated to the fixed version 1.1.3.0 is susceptible.

Risk and Exploitability

The CVSS base score of 8.3 indicates high severity. The EPSS score of < 1% suggests a low probability of exploitation today. Based on the description, it is inferred that exploit requires local process access due to the localhost binding of the WebSocket server, so an attacker must already have local process on the same machine to exploit the flaw. No evidence of remote or network exploitation is provided in the description. The vulnerability is not listed in CISA KEV, and there are no known public exploits available at present.

Generated by OpenCVE AI on July 21, 2026 at 12:33 UTC.

Remediation

Vendor Solution

The vulnerability has been patched with GeoWebPlayer V1.1.3.0

OpenCVE Recommended Actions

  • Apply the official patch to GeoWebPlayer v1.1.3.0.
  • If patching is not possible immediately, disable or block the GeoWebPlayer WebSocket service to prevent local processes from sending malicious commands (CWE‑129).
  • Enable monitoring or logging of WebSocket activity to detect abnormal index values and potential exploitation attempts.

Generated by OpenCVE AI on July 21, 2026 at 12:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Description GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound. ### saveVideo command index-out-of-bound When sending the `saveVideo` command, the `index` field is extracted from the websocket message [1]. Then without checking the range of the index, it is used to trigger a CriticalSection ([2]) and releases it [3]. The release function call ([3]) is executed using a function pointer which will be read out of bounds potentially leading to code execution: v6 = get_entry(a2, "index"); result = json_is_value_int(v6); if ( (_BYTE)result ) { v8 = get_entry(a2, "index"); index = json_value_to_int(&v8->value); // [1] result = CCriticalSection::EnterCritSection(&this->crit_sections[index]); //[2] if ( result ) { if ( this->array_of_IPCams[index] ) { if ( this->array_of_IPCams[index]->field_20 ) do_PostMessageA((CViewer *)this->array_of_IPCams[index], 0x111u, 0x139Fu, v11); } return (*(int (__thiscall **)(CCriticalSection *))(this->crit_sections[index].vtbl + 20))(&this->crit_sections[index]); //[3] } }
Title GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability
First Time appeared Geovision Inc.
Geovision Inc. geowebplayer
Weaknesses CWE-129
CPEs cpe:2.3:a:geovision_inc.:geowebplayer:v1.1.1.0:*:64_bit:*:*:*:*:*
cpe:2.3:a:geovision_inc.:geowebplayer:v1.1.1.0:*:windows:*:*:*:*:*
cpe:2.3:a:geovision_inc.:geowebplayer:v1.1.3.0:*:64_bit:*:*:*:*:*
cpe:2.3:a:geovision_inc.:geowebplayer:v1.1.3.0:*:windows:*:*:*:*:*
Vendors & Products Geovision Inc.
Geovision Inc. geowebplayer
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

Geovision Inc. Geowebplayer
cve-icon MITRE

Status: PUBLISHED

Assigner: GV

Published:

Updated: 2026-07-02T12:35:19.946Z

Reserved: 2026-06-24T05:48:03.740Z

Link: CVE-2026-57268

cve-icon Vulnrichment

Updated: 2026-07-02T12:35:16.401Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T12:45:02Z

Weaknesses
  • CWE-129

    Improper Validation of Array Index