The vulnerability is a stack-based buffer overflow in the GeoWebPlayer WebSocket server’s connectInfo command handler. The function handle_connect_info copies attacker‑controlled JSON strings into fixed‑size buffers using manual byte‑by‑byte loops that do not enforce length limits. A crafted payload can overflow the stack, corrupting return addresses or other control data and allowing an attacker with access to the local socket to execute arbitrary code with the privileges of the GeoWebPlayer process. The weakness is a classic input‑validation flaw identified as CWE‑120.

Affected: GeoVision Inc.’s GeoWebPlayer version 1.1.1.0 on both 64‑bit and Windows platforms. The vendor released a patch in GeoWebPlayer V1.1.3.0 that resolves the unchecked copy. Deployments that remain on 1.1.1.0 or earlier are vulnerable.

The CVSS score of 8.3 indicates a high severity impact, but the EPSS score of <1% signals a very low probability of widespread exploitation. The vulnerability is not listed in CISA KEV, suggesting no known large‑scale incidents. Because the WebSocket server accepts commands from localhost and no authentication or network restriction is documented, the likely attack vector is local execution by a user or process with matched privileges. An attacker who can run a privileged local process that reaches the socket can exploit the overflow to gain code execution.