GeoWebPlayer implements a WebSocket server that accepts commands from localhost. The connectionInfo command is processed by a handler that manually copies attacker‑controlled JSON strings into fixed buffers without enforcing length limits, which is a classic stack‑based buffer overflow (C Exploiting the flaw can result in arbitrary code execution on the host running GeoWebPlayer.

GeoVision Inc.’s GeoWebPlayer is affected in version 1.1.1.0 for 64‑bit and Windows builds. The vendor has released version 1.1.3.0 that fixes the unbounded string copies, so this patch should be applied to all installations.

The CVSS base score of 8.3 classifies this vulnerability as high severity, but the EPSS score of <1% and its absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. Because the attack vector is local—only entities that can reach the localhost WebSocket server can trigger the buffer overflow—the risk is limited to systems that expose the plugin to local services or where the WebSocket port is reachable from untrusted networks.