What is the CVSS score of CVE-2026-57270?

CVE-2026-57270 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoWebPlayer are affected by CVE-2026-57270?

GeoVision GeoWebPlayer, a websocket addon bundled with GV-VMS and GV-Cloud surveillance deployments, contains a high-severity out-of-bounds memory access vulnerability (CVE-2026-57270, CVSS 8.3) with…

How to fix or mitigate CVE-2026-57270?

Within 24 hours: Identify all systems running GeoVision GeoWebPlayer through asset inventory; cross-reference against vendor security advisory to determine affected versions; disable the Web Plugin/WS Player service if not operationally critical. Within 7 days: Engage GeoVision support for interim workarounds and vendor patch timeline; implement network segmentation to restrict websocket access to trusted hosts; filter or restrict employee web browsing to reduce attack surface. Within 30 days: Deploy vendor-released patch across all affected GV-VMS and GV-Cloud instances; validate post-patch functionality; deactivate compensating controls once patches are confirmed stable.

GeoWebPlayer CVE-2026-57270

EUVD-2026-41232 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-32xw-36xq-2pw2

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Browser bridges to the localhost websocket (AV:N) but needs victim navigation (UI:R) and a working OOB index (AC:H); no auth (PR:N); cross-component reach (S:C) with memory disclosure and corruption impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:51 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

play command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision GeoWebPlayer (a.k.a. "Web Plugin"/"WS Player"), a websocket-server addon bundled with GV-VMS, GV-Cloud and related GeoVision software, lets an attacker who lures a victim to a malicious web page reach the localhost websocket and supply an unvalidated index to leak memory and corrupt state (CWE-129). The play command in particular accepts an attacker-controlled index used to index internal arrays without a range check, enabling information disclosure and potential code-path corruption. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the vendor has published a security advisory and Talos has released a detailed report.

Technical ContextAI

GeoWebPlayer runs a local websocket server (bound to localhost) that bridges GeoVision browser-based interfaces to native playback/streaming functionality - necessary for the web UIs of GV-VMS and VMS-Cloud to operate. The server dispatches a command protocol in which many commands carry an index parameter used to select entries from internal arrays that guard critical sections, drive function calls, and manage playback state. Because these indices are trusted without bounds validation, they map directly to CWE-129 (Improper Validation of Array Index): an attacker-chosen index reads or references memory outside the intended array. The affected component is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*, meaning all versions prior to the fix are implicated. Although the websocket only accepts connections from localhost, the CVSS AV:N with UI:R indicates the realistic reach is a browser-based cross-origin/DNS-rebinding style path where a victim's browser is used to deliver commands to the local server.

RemediationAI

Patch available per vendor advisory: apply the fixed GeoWebPlayer/Web Plugin build referenced on the GeoVision cyber security page (https://www.geovision.com.tw/cyber_security.php); the input does not specify an exact fix version, so confirm the patched build against that advisory and the Talos report (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373). Where immediate patching is not possible, reduce exposure by uninstalling or stopping the GeoWebPlayer addon on hosts that do not require the web interface (trade-off: the GV-VMS/VMS-Cloud browser UIs relying on the local websocket will lose functionality), and by restricting which browsers/pages users open on machines running the plugin since exploitation is browser-mediated. As additional hardening against the cross-origin/DNS-rebinding delivery path, ensure the websocket server enforces strict Origin/Host validation and bind it to loopback only (trade-off: may require vendor configuration and could break intended web integrations if origins are misconfigured).