What is the CVSS score of CVE-2026-13131?

CVE-2026-13131 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-13131?

GeoVision GeoWebPlayer, a web plugin bundled with GV-VMS and GV-Cloud surveillance systems, contains a memory corruption vulnerability (CVE-2026-13131, CVSS 8.3) that allows remote attackers to…

How to fix or mitigate CVE-2026-13131?

Within 24 hours: Inventory all systems running GeoVision GeoWebPlayer and restrict web access from these systems to trusted, internal sources only; disable WebPlayer if not required for operations. Within 7 days: Implement network-level controls to block external WebSocket connections to affected GeoVision systems; review and restrict direct web access to the GeoWebPlayer interface. Within 30 days: Monitor GeoVision security advisories for patch availability; conduct forensic review of access logs for exploitation indicators; evaluate architectural alternatives or air-gapped deployment for critical surveillance infrastructure.

GeoVision GeoWebPlayer CVE-2026-13131

EUVD-2026-41242 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-w252-599c-qm84

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Browser-delivered attack to a local WebSocket gives AV:N with UI:R and PR:N; out-of-bounds memory manipulation makes it AC:H; addon-to-host boundary crossing yields S:C with full CIA impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:46 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

connectInfo command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and related software) lets a remote attacker corrupt memory via the local WebSocket server's connectInfo command. Because the server trusts an attacker-supplied index without range validation, a victim lured to a malicious web page can trigger high-impact confidentiality, integrity and availability effects (CVSS 8.3, scope-changed). No public exploit identified at time of analysis; the flaw was reported by the vendor (GV) and documented by Cisco Talos.

Technical ContextAI

GeoWebPlayer runs a local WebSocket server that bridges GeoVision's browser-based interfaces (GV-VMS, GV-Cloud, VMS-Cloud) to native player functionality. Commands accepted over this socket carry an index value used to index internal arrays for entering critical sections and dispatching function calls. The root cause is CWE-129 (Improper Validation of Array Index): the connectInfo handler dereferences the caller-controlled index without bounds checking, permitting reads/writes outside the intended array. The affected component is identified in CPE as cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*, and the Tags flag Information Disclosure as a primary consequence, consistent with out-of-bounds reads leaking adjacent memory.

RemediationAI

No vendor-released patch version is identified in the provided data; consult the GeoVision advisory at https://www.geovision.com.tw/cyber_security.php and Talos report https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373 for a fixed build and apply it once available. As a compensating control, uninstall or disable the GeoWebPlayer/Web Plugin addon on hosts where the GeoVision web interfaces do not require it (trade-off: some web-interface playback features may stop functioning). Where the addon is needed, avoid using the same host for general web browsing since the delivery path is a browser connecting to the localhost WebSocket, and use host firewall/endpoint rules to limit which processes can reach the local WebSocket port. Keep operator workstations off untrusted networks and enforce strict web content controls to reduce the chance a malicious page reaches the local socket.