The vulnerability is an out-of-bounds read (CWE-129) in the GeoVision GeoWebPlayer WebSocket server triggered by a pause command with an invalid index. This flaw permits a remote attacker to read memory beyond the intended bounds of the GeoWebPlayer process when connected to the WebSocket endpoint, potentially exposing sensitive application data stored in memory. While the CVE does not enumerate specific data that could be accessed, an out-of-bounds read can leak confidential information if the memory contains such data.

GeoVision Inc.’s GeoWebPlayer version 1.1.1.0 on both 64‑bit Linux and Windows platforms is affected. The vendor has issued GeoWebPlayer 1.1.3.0 that includes the fix, so any system still running 1.1.1.0 remains vulnerable.

The CVSS score of 8.3 indicates a high severity vulnerability. The EPSS score of under 1% suggests a low current likelihood of exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote network access to the WebSocket endpoint, inferred from the description that the flaw is triggered when the GeoWebPlayer WebSocket server processes a pause command. If exploited, an attacker who can reach the service can trigger the out-of-bounds read and potentially access memory contents.