What is the CVSS score of CVE-2026-57264?

CVE-2026-57264 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-57264?

GeoVision GeoWebPlayer (branded as Web Plugin in GV-VMS and WS Player in VMS-Cloud) contains a high-severity memory access vulnerability (CVSS 8.3) that could enable disclosure of sensitive…

How to fix or mitigate CVE-2026-57264?

24 hours: Identify and inventory all GeoVision GeoWebPlayer, GV-VMS Web Plugin, and VMS-Cloud WS Player instances across the enterprise. 7 days: Implement network segmentation restricting WebSocket traffic to these add-ons to administrative-only networks; disable the web plugin entirely if operationally unnecessary. 30 days: Track Cisco Talos and GeoVision security advisories for patch release; evaluate alternative surveillance platforms with stronger memory-safety guardrails.

GeoVision GeoWebPlayer CVE-2026-57264

EUVD-2026-41226 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-2wcm-g247-vx59

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Cross-site WebSocket gives AV:N/PR:N but AC:H and UI:R since the victim must run the addon and visit a malicious page; scope changes from browser to local process; primary impact is memory read (C:H) plus crash (A:H), integrity lowered to L absent confirmed corruption.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:47 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

setPIP command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker corrupt or read process memory by sending crafted WebSocket commands to the localhost server the addon exposes. The specific 'setPIP' command accepts an attacker-controlled 'index' that is used to index internal arrays without range validation, yielding information disclosure and potential memory corruption. There is no public exploit identified at time of analysis, though a Cisco Talos technical report (TALOS-2026-2373) documents the flaw; it is not listed in CISA KEV and no EPSS score is provided.

Technical ContextAI

GeoWebPlayer is a browser-companion addon bundled with GeoVision surveillance/VMS products (GV-VMS, GV-Cloud) that runs a local WebSocket server so browser-based web interfaces can drive native player capabilities. The root cause is CWE-129 (Improper Validation of Array Index): many WebSocket command handlers take a caller-supplied 'index' and use it directly to index arrays that gate critical sections, dispatch function calls, or reference player objects. Because the index is not bounds-checked, values outside the valid range dereference memory outside the intended array - in the setPIP (picture-in-picture) handler this produces an out-of-bounds access. The single affected package is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*, with no version boundaries enumerated in the provided data.

RemediationAI

Consult the GeoVision cyber security advisory at https://www.geovision.com.tw/cyber_security.php and the Talos report at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373 for the fixed build, and upgrade GeoWebPlayer to the vendor-patched version once identified - no exact fix version is present in the provided data, so patch status is best described as 'Patch available per vendor advisory' pending confirmation of an exact build number. Because the attack requires the addon's localhost WebSocket to be reachable from a browser, effective compensating controls where patching is not yet possible include uninstalling GeoWebPlayer on hosts that do not need the browser player (trade-off: web interfaces depending on it lose functionality), firewalling or blocking the local WebSocket listener port from browser processes, and restricting operator workstations that run GeoVision software from general web browsing so they cannot be lured to a malicious page (trade-off: reduced usability on those endpoints). Browser-side blocking of untrusted sites is weaker because the attack rides an ordinary cross-site WebSocket connection.