GeoWebPlayer includes a WebSocket server that accepts connections only from localhost. The handler for the connectionInfo command, handle_connect_info, copies attacker‑controlled JSON strings into fixed‑size buffers using manual copy loops without bounds checking. This stack‑based buffer overflow allows an attacker to corrupt stack data and execute arbitrary code in the WebSocket process, as defined by CWE‑120.

The vulnerability affects GeoVision Inc.’s GeoWebPlayer software. All releases up to and including 1.1.1.0 on 64‑bit and Windows platforms are vulnerable. Versions 1.1.3.0 and newer contain the patch. The affected installations are typically bundled with GeoVision GV‑VMS or GV‑Cloud systems that use the GeoWebPlayer add‑on.

The CVSS base score of 8.3 signals high severity. The EPSS score of <1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers must have local access to the host to send a malicious JSON payload over the WebSocket, so the vector is local. Successful exploitation would grant code execution in the context of the WebSocket process and could lead to privilege escalation if that process runs with elevated permissions.