What is the CVSS score of CVE-2026-57264?

CVE-2026-57264 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-57264?

GeoVision GeoWebPlayer (branded as Web Plugin in GV-VMS and WS Player in VMS-Cloud) contains a high-severity memory access vulnerability (CVSS 8.3) that could enable disclosure of sensitive…

How to fix or mitigate CVE-2026-57264?

24 hours: Identify and inventory all GeoVision GeoWebPlayer, GV-VMS Web Plugin, and VMS-Cloud WS Player instances across the enterprise. 7 days: Implement network segmentation restricting WebSocket traffic to these add-ons to administrative-only networks; disable the web plugin entirely if operationally unnecessary. 30 days: Track Cisco Talos and GeoVision security advisories for patch release; evaluate alternative surveillance platforms with stronger memory-safety guardrails.

GeoVision GeoWebPlayer CVE-2026-57264

EUVD-2026-41226 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-2wcm-g247-vx59

Information Disclosure Geowebplayer

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Cross-site WebSocket gives AV:N/PR:N but AC:H and UI:R since the victim must run the addon and visit a malicious page; scope changes from browser to local process; primary impact is memory read (C:H) plus crash (A:H), integrity lowered to L absent confirmed corruption.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:47 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

setPIP command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker corrupt or read process memory by sending crafted WebSocket commands to the localhost server the addon exposes. The specific 'setPIP' command accepts an attacker-controlled 'index' that is used to index internal arrays without range validation, yielding information disclosure and potential memory corruption. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure operator running GeoWebPlayer to malicious page

Delivery

Page opens WebSocket to localhost server

Exploit

Send setPIP with out-of-range index

Execution

Trigger out-of-bounds array access

Impact

Leak process memory / corrupt state

Access

Lure operator running GeoWebPlayer to malicious page

Delivery

Page opens WebSocket to localhost server

Exploit

Send setPIP with out-of-range index

Execution

Trigger out-of-bounds array access

Impact

Leak process memory / corrupt state

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target host has the optional GeoWebPlayer / 'Web Plugin' / 'WS Player' addon installed and running its localhost WebSocket server (it ships alongside GV-VMS, GV-Cloud, and VMS-Cloud but is not always present), and that the victim actively visits an attacker-controlled web page in a browser on that host (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 3.1 score is 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a web page containing JavaScript that opens a WebSocket to the GeoWebPlayer server on localhost and issues a setPIP command with an out-of-range index; when a GeoVision operator who has the addon installed visits that page, the malicious index drives an out-of-bounds array access in the player process, leaking memory contents back to the attacker and potentially corrupting process state. No public exploit is identified at time of analysis, but the Talos report documents the technical mechanism, lowering weaponization difficulty.
Remediation	Consult the GeoVision cyber security advisory at https://www.geovision.com.tw/cyber_security.php and the Talos report at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373 for the fixed build, and upgrade GeoWebPlayer to the vendor-patched version once identified - no exact fix version is present in the provided data, so patch status is best described as 'Patch available per vendor advisory' pending confirmation of an exact build number. … Detailed patch versions, workarounds, and compensating controls in full report.