GeoWebPlayer includes a WebSocket server that accepts JSON commands from localhost. The connectionInfo command is processed by a handler that copies inbound JSON strings into fixed buffers using unchecked, byte‑by‑byte loops. This results in a classic stack‑based buffer overflow (CWE‑120). An attacker who can send crafted JSON to the WebSocket endpoint could trigger the overflow, taking arbitrary control of the process running GeoWebPlayer and compromising the host.

GeoVision Inc.'s GeoWebPlayer v1.1.1.0 on 64‑bit and Windows builds is vulnerable. The vendor has released v1.1.3.0, which implements bounds checking and eliminates the overflow. All installations of the affected version should be updated.

The CVSS base score of 8.3 indicates high severity, and the EPSS score of <1% suggests a low likelihood of widespread exploitation. The flaw requires local access to the WebSocket server; therefore, exposure of the listening port beyond the host restricts the attack surface. While not listed in the CISA KEV catalog, the vulnerability remains a serious local privilege concern for systems where the plugin runs with elevated permissions.