A stack-based buffer overflow exists in GeoWebPlayer’s websocket server handler for the connectionInfo command. The handler copies attacker‑controlled JSON strings into fixed-size buffers using unchecked byte‑by‑byte loops, which can overwrite the stack frame and allow an attacker to execute arbitrary code on the host running the websocket service. This flaw is identified as CWE‑120 and is rated 8.3 on the CVSS scale, indicating that exploitation can lead to full control of the affected machine if the attacker can supply the crafted payload.

The vulnerability affects GeoVision Inc.’s GeoWebPlayer product versions 1.1.1.0 and earlier, available for both 64‑bit Linux and Windows platforms. The fixed version is 1.1.3.0, released by the vendor to eliminate the unsafe copy loops. Any deployment of the unpatched GeoWebPlayer is susceptible to this flaw.

The EPSS score of < 1% suggests that exploitation attempts are currently rare, and the flaw is not listed in CISA’s KEV catalog. Because the websocket interface is bound to localhost, the likely attack vector is local; remote attackers must first gain local execution rights or compromise a service that can communicate with the socket. Successful local exploitation would grant an attacker full control of the host. Prompt patching remains the primary defense against this vulnerability.