The vulnerability is a stack‑based buffer overflow in the GeoWebPlayer WebSocket server’s connectionInfo handler. The handle_connect_info routine copies attacker‑controlled JSON strings into fixed‑size buffers one byte at a time without enforcing length limits. This flaw allows a malicious payload to overwrite stack data, leading to arbitrary code execution in the WebSocket process, as defined by CWE‑120.

GeoVision Inc.’s GeoWebPlayer plug‑in up to version 1.1.1.0 on both 64‑bit and Windows platforms is affected. The vulnerability is corrected in the 1.1.3.0 release that ships with GeoVision’s GV‑VMS, GV‑Cloud and other systems that use the GeoWebPlayer add‑on.

The CVSS base score of 8.3 indicates high severity, while the EPSS score of <1% suggests a very low exploitation probability in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the host to send a crafted JSON payload over the WebSocket, so the attack vector is local. Successful exploitation would grant code execution in the WebSocket process and could lead to privilege escalation if the process runs with elevated permissions.