GeoWebPlayer, an addon for GeoVision software, implements a WebSocket server that listens for commands on the local host. The handler for the "connectionInfo" command copies attacker‑controlled JSON strings into fixed-size buffers without enforcing length limits, creating a stack‑based buffer overflow (CWE‑120). If an attacker can send an oversized payload, the overflow can overwrite return addresses and potentially execute arbitrary code or crash the service. The vulnerability is thus a local code‑execution vector.

The flaw affects GeoVision Inc.’s GeoWebPlayer versions 1.1.1.0 on both 64‑bit and Windows platforms. The vendor has released a patch in GeoWebPlayer v1.1.3.0 that introduces bounds checking in the vulnerable routine.

With a CVSS score of 8.3 the vulnerability is high severity, but the EPSS score of less than 1 % indicates a very low current exploitation probability. It is not listed in CISA’s KEV catalog. The WebSocket server listens on localhost; therefore, the likely attack vector is a local user or a process with local privileges. If the service were exposed to external traffic, the risk would increase, but the current description does not confirm such exposure.