GeoWebPlayer, an add‑on for GeoVision software, hosts a WebSocket server that accepts commands from the local host. The connectionInfo handler (handle_connection_info) copies attacker‑controlled JSON into fixed‑size buffers without length checks, creating a stack‑based buffer overflow. An oversized payload can corrupt the stack and allows an attacker to overwrite return addresses, potentially executing arbitrary code or crashing the service.

The flaw affects GeoVision Inc.’s GeoWebPlayer version 1.1.1.0 on both 64‑bit and Windows platforms. The vendor has released a patch in GeoWebPlayer v1.1.3.0 that adds bounds checking to the vulnerable routine.

With a CVSS score of 8.3 the vulnerability is high severity, but the EPSS score of less than 1 % indicates a very low current exploitation probability. It is not listed in CISA’s KEV catalog. The WebSocket server listens on localhost, so a local attacker or one who can inject traffic into the local interface to external hosts, the risk would be higher, but the current description does not confirm such exposure.