GeoVision GeoWebPlayer CVE-2026-57264

Exploitation requires that the target host has the optional GeoWebPlayer / 'Web Plugin' / 'WS Player' addon installed and running its localhost WebSocket server (it ships alongside GV-VMS, GV-Cloud, and VMS-Cloud but is not always present), and that the victim actively visits an attacker-controlled web page in a browser on that host (UI:R). The attacker must then have a cross-origin WebSocket handshake accepted by the local server and send a setPIP command carrying an index outside the valid array range. Limiting factors: the addon must be installed and active, user interaction (browsing to a malicious page) is mandatory, and attack complexity is High per CVSS, meaning the attacker must also reliably reach and connect to the specific local service - there is no fully unauthenticated, no-interaction remote path.

The vendor CVSS 3.1 score is 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. The AV:N rating initially appears to conflict with the description's statement that commands come from localhost, but the two reconcile: the practical attack is a cross-site WebSocket connection - a victim already running GeoWebPlayer visits an attacker-controlled web page, which then connects to the localhost WebSocket and issues the malicious commands. This is why UI:R (victim must browse to a malicious page) and AC:H (attacker must lure the victim and win a cross-origin handshake against a specific local service) are set, and why scope is Changed (S:C) - a web origin reaches into a separate local process. No EPSS score, no KEV listing, and no confirmed public exploit are present, so despite the High base score there is no evidence of widespread active exploitation; realistic risk is bounded by the requirements that the victim run the addon AND actively visit a malicious page. The 'Information Disclosure' tag suggests the demonstrated impact is primarily a memory read (leak) rather than reliable code execution, so the I:H/A:H components should be treated as vendor-assessed upper bounds pending independent confirmation.

An attacker crafts a web page containing JavaScript that opens a WebSocket to the GeoWebPlayer server on localhost and issues a setPIP command with an out-of-range index; when a GeoVision operator who has the addon installed visits that page, the malicious index drives an out-of-bounds array access in the player process, leaking memory contents back to the attacker and potentially corrupting process state. No public exploit is identified at time of analysis, but the Talos report documents the technical mechanism, lowering weaponization difficulty.