What is the CVSS score of CVE-2026-13132?

CVE-2026-13132 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-13132?

GeoVision's GeoWebPlayer and related video management system components contain a memory corruption vulnerability (CVSS 8.3) exploitable through web browser interaction.

How to fix or mitigate CVE-2026-13132?

Within 24 hours: identify all GeoWebPlayer, Web Plugin, and WS Player instances across GV-VMS and VMS-Cloud systems. Within 7 days: contact GeoVision support to confirm patch availability timeline and assess risk to production surveillance systems. Within 30 days: apply vendor patch when released, or implement network-based compensating controls to restrict vector.

GeoVision GeoWebPlayer CVE-2026-13132

EUVD-2026-41243 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-hg87-2hf8-7633

Information Disclosure Geowebplayer

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Browser-pivot to a localhost service gives AV:N/S:C but needs a crafted page and user visit (AC:H, UI:R, PR:N); info-disclosure is the confirmed C:H impact while OOB corruption yields only inferred low integrity/availability effects.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:46 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

setStream command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker abuse the addon's localhost WebSocket server via a crafted 'setStream' command whose attacker-controlled 'index' is used to index arrays without range validation (CWE-129), enabling memory disclosure and possible corruption. Because a victim's browser can be steered into connecting to the local WebSocket service, the vendor rates this AV:N/UI:R (CVSS 8.3) - a remote web page can pivot to the local service after the user visits it. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to malicious web page

Delivery

Browser connects to localhost WebSocket server

Exploit

Send setStream with out-of-range index

Execution

Trigger out-of-bounds array access (CWE-129)

Impact

Disclose process memory or crash service

Access

Lure victim to malicious web page

Delivery

Browser connects to localhost WebSocket server

Exploit

Send setStream with out-of-range index

Execution

Trigger out-of-bounds array access (CWE-129)

Impact

Disclose process memory or crash service

Vulnerability AssessmentAI

Exploitation	Exploitation requires the GeoWebPlayer/Web Plugin/WS Player addon to be installed and running its localhost WebSocket server on the victim host, and it requires user interaction (UI:R) - the victim must visit an attacker-controlled web page that pivots the browser into connecting to that local WebSocket service. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H = 8.3) reflects a browser-pivot attack: although the WebSocket only accepts localhost connections, a remote malicious page can cause the victim's browser to reach it (hence AV:N and the changed scope S:C), but this requires user interaction (UI:R) and non-trivial setup such as DNS rebinding or a crafted page (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker lures a user who has GeoWebPlayer installed to a malicious web page; the page (e.g., via DNS rebinding) causes the browser to open a WebSocket connection to the local GeoWebPlayer server and send a setStream command with an out-of-range index. The unchecked index drives an out-of-bounds array access, leaking process memory back to the attacker or corrupting state to crash or potentially subvert the service. …
Remediation	Consult the GeoVision advisory (https://www.geovision.com.tw/cyber_security.php) and apply the patched GeoWebPlayer/Web Plugin/WS Player build for your GeoVision product; an exact fixed version is not specified in the available data, so confirm the release number with the vendor advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.