GeoVision Inc.'s GeoWebPlayer addon creates a WebSocket server that enables advanced functionality for GeoVision software. In version 1.1.1.0, a pause command sent to the WebSocket server triggers a buffer underflow that results in an out-of-bounds read (CWE‑129). The vulnerable code can read memory beyond the intended buffer, potentially exposing arbitrary data stored on the host. The official description states that the flaw is triggered when the server processes a pause command, but does not detail the exact data that could be leaked; however, any data residing adjacent to the buffer may become accessible.

Both 64‑bit and Windows installations of GeoWebPlayer 1.1.1.0 are affected. The vendor has released version 1.1.3.0 that contains the fix, so any system still running 1.1.1.0 remains vulnerable.

The CVSS score of 8.3 categorises this bug as high severity. EPSS indicates a probability of exploitation below 1 percent, and the vulnerability is not listed in CISA’s KEV catalogue. Based on the description, it is inferred that the likely attack vector is remote over the network: an attacker who can reach the WebSocket endpoint can send a pause command to trigger the out-of-bounds read and read memory content. The CVE description does not specify an authentication or privilege requirement beyond access to the WebSocket service, so any client with network reachability could potentially exploit the flaw.