GeoVision GeoWebPlayer incorporates a stack‑based buffer overflow in the WebSocket server’s connectInfo command handler. The handler copies attacker‑controlled JSON strings into fixed‑size buffers using manual byte‑by‑byte loops that do not enforce length limits. A crafted payload can therefore overflow the buffer, corrupt the stack and enable arbitrary code execution on the host that runs GeoWebPlayer. The main weakness is a classic input‑validation flaw (CWE‑120).

The affected product is GeoVision Inc.’s GeoWebPlayer version 1.1.1 platforms. GeoVision released a patch in GeoWebPlayer v1.1.3.0 that corrects the unchecked copy and enforces proper buffer bounds. Deployments that have not upgraded remain vulnerable.

The CVSS score of 8.3 indicates a high severity impact. The EPSS score of <1% suggests a very low probability of wild exploitation. GeoVision’s fix is not listed in CISA KEV, implying no widespread incidents are currently known. The WebSocket server accepts commands from localhost, so the likely attack vector is local. If an attacker can run a local process that reaches the socket, they can trigger the overflow; there is no documented authentication or network restriction in the description.