What is the CVSS score of CVE-2026-57266?

CVE-2026-57266 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by CVE-2026-57266?

GeoVision's GeoWebPlayer addon (deployed in GV-VMS and VMS-Cloud surveillance systems) contains a memory-corruption vulnerability (CVSS 8.3) that allows attackers with access to the WebSocket service…

How to fix or mitigate CVE-2026-57266?

Within 24 hours: Identify all systems running GeoVision GeoWebPlayer addon; determine current network exposure of the WebSocket service and whether web interfaces are externally accessible. Within 7 days: Deploy firewall rules to restrict WebSocket port access to trusted administrator networks only; evaluate disabling web interfaces if business operations permit. Within 30 days: Subscribe to GeoVision security advisories for patch release notifications; develop and test upgrade plan for patched versions.

GeoVision GeoWebPlayer CVE-2026-57266

EUVD-2026-41228 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-2xjx-g628-x8w8

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Reached via browser pivot to a localhost service so AV:N/UI:R/AC:H/S:C/PR:N; OOB read primarily discloses memory (C:H, Information Disclosure tag) with only limited corruption/crash potential (I:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:48 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

2wayAudio command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' for VMS-Cloud) lets an attacker corrupt memory or leak sensitive data by sending a 2wayAudio WebSocket command with an unchecked index value. The addon runs a localhost WebSocket server that expands GeoVision web interfaces, and its command handlers use caller-supplied index values to index internal arrays without validating their range. Reported by GeoVision and Talos (TALOS-2026-2373); no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

GeoWebPlayer is a companion addon installed alongside GeoVision surveillance products (GV-VMS, GV-Cloud, VMS-Cloud) that opens a local WebSocket server so browser-based web interfaces can drive richer functionality such as two-way audio. The root cause is CWE-129 (Improper Validation of Array Index): command handlers accept an 'index' parameter over the WebSocket and use it directly to index arrays that gate critical sections, dispatch function calls, and select resources. Because the index is not bounds-checked, a crafted value reads or writes outside the intended array, corrupting adjacent memory or dereferencing attacker-influenced entries. The CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:* covers all versions, and the specific instance called out here is the 2wayAudio command path.

RemediationAI

Consult the GeoVision cyber security advisory (https://www.geovision.com.tw/cyber_security.php) and apply the vendor-supplied update for GeoWebPlayer as the primary fix; no exact fixed version is provided in the available data, so verify the patched build against the advisory before deployment. If a patch cannot be applied immediately, uninstall or disable the GeoWebPlayer/Web Plugin/WS Player addon on hosts that do not require the enhanced web-interface features (this disables browser-driven two-way audio and similar capabilities), or prevent untrusted web content from reaching the loopback WebSocket listener - for example via host firewall rules on the loopback port or by not browsing untrusted sites from operator workstations running the addon. The trade-off is loss of the addon-dependent web functionality. Cross-reference the Talos report (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373) for the affected command surface.