An unvalidated index parameter in the GeoWebPlayer websocket command handler allows an attacker to cause out-of-bounds memory reads, potentially exposing arbitrary memory contents. The vulnerability is documented as a range check failure (CWE-129) and could compromise confidentiality if sensitive data resides in the affected memory regions.

GeoVision Inc.’s GeoWebPlayer component, specifically version 1.1.1.0 running on either 64‑bit or Windows platforms, is susceptible. The issue is addressed in GeoWebPlayer V1.1.3.0, which implements bounds checking for the index field in websocket commands.

The base CVSS score of 8.3 indicates high severity; the EPSS score of less than 1% suggests low observed exploitation probability, and it is not listed in CISA KEV catalogs. Exploitation requires an attacker to send a crafted websocket request to the server. The component typically listens on localhost, making local access the most likely vector, but if the service is exposed to external networks, remote exploitation becomes feasible. Successful exploitation would allow the attacker to read arbitrary memory and gain confidential information.