EUVD-2026-41232
GHSA-32xw-36xq-2pw2
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Browser bridges to the localhost websocket (AV:N) but needs victim navigation (UI:R) and a working OOB index (AC:H); no auth (PR:N); cross-component reach (S:C) with memory disclosure and corruption impact.
Primary rating from Vendor (GV).
CVSS VectorVendor: GV
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.
The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.
play command index-out-of-bound
AnalysisAI
Out-of-bounds array access in GeoVision GeoWebPlayer (a.k.a. "Web Plugin"/"WS Player"), a websocket-server addon bundled with GV-VMS, GV-Cloud and related GeoVision software, lets an attacker who lures a victim to a malicious web page reach the localhost websocket and supply an unvalidated index to leak memory and corrupt state (CWE-129). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that GeoWebPlayer (the Web Plugin / WS Player addon) be installed and its localhost websocket server running on the victim host, and that the victim be induced to open attacker-controlled web content in a browser (UI:R) that can reach the localhost websocket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - network reachable but with high attack complexity and required user interaction, offset by no privileges needed and a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page that, when opened by a user on a machine running GeoWebPlayer, connects to the local websocket server and issues a play command with an out-of-range `index`. The server uses that index to access internal arrays out of bounds, leaking sensitive memory back to the attacker's page and potentially corrupting playback state. … |
| Remediation | Patch available per vendor advisory: apply the fixed GeoWebPlayer/Web Plugin build referenced on the GeoVision cyber security page (https://www.geovision.com.tw/cyber_security.php); the input does not specify an exact fix version, so confirm the patched build against that advisory and the Talos report (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running GeoVision GeoWebPlayer through asset inventory; cross-reference against vendor security advisory to determine affected versions; disable the Web Plugin/WS Player service if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Geowebplayer
View allMissing authentication in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Clo
Remote code execution in GeoVision GeoWebPlayer (the browser-facing 'Web Plugin'/'WS Player' addon bundled with GV-VMS,
Cross-site WebSocket-driven buffer overflow in GeoVision GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with G
Buffer overflow vulnerabilities in GeoVision's GeoWebPlayer WebSocket addon (CWE-120) allow a remote attacker to induce
Remote code execution in GeoVision GeoWebPlayer (the "Web Plugin"/"WS Player" addon bundled with GV-VMS, GV-Cloud and VM
Out-of-bounds array access in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS
Buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" in GV-VMS and "WS Player" in VMS-Cloud) all
Stack buffer overflow in GeoVision's GeoWebPlayer addon (also branded "Web Plugin" for GV-VMS and "WS Player" for VMS-Cl
Out-of-bounds array access in GeoVision's GeoWebPlayer add-on (also branded 'Web Plugin' for GV-VMS and 'WS Player' for
Out-of-bounds array access in GeoVision's GeoWebPlayer (a.k.a. 'Web Plugin' / 'WS Player') addon lets an attacker read m
Out-of-bounds array indexing in GeoVision's GeoWebPlayer addon (also branded 'Web Plugin' in GV-VMS and 'WS Player' in V
Out-of-bounds array access in GeoVision's GeoWebPlayer (the 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today