GeoWebPlayer’s websocket server accepts JSON payloads for the connectionInfo command and copies them into fixed‑size buffers using unchecked byte‑by‑byte loops. This stack‑based buffer overflow (CWE‑120) can overwrite the return address and allows an attacker controlling the JSON input to execute arbitrary code on the host where the websocket server runs. The vulnerability is rated 8.3 on the CVSS scale, indicating a significant potential for privilege escalation and full system compromise when the attacker has local execution rights.

The flaw resides in GeoVision Inc.’s GeoWebPlayer 1.1.1.0, which is deployed on both 64‑bit Linux and Windows environments. The vendor released GeoWebPlayer 1.1.3.0 that removes the unsafe copy loops and fixes the overflow. Any installation of GeoWebPlayer equal to or older than 1.1.1.0, lacking the patch, is potentially vulnerable.

This high‑severity vulnerability has an EPSS score of < 1%, suggesting that exploitation attempts are currently rare. Based on the description, the likely attack vector is local; the websocket interface is bound to localhost, so remote attackers must first gain local code execution or compromise a local service that can communicate with the socket. While the risk of remote exploitation is limited, the impact of successful local exploitation is severe, providing full control over the affected machine. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly documented exploits at this time. Prompt patching remains the best defense.