What is the CVSS score of CVE-2026-57274?

CVE-2026-57274 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoWebPlayer are affected by CVE-2026-57274?

GeoVision's GeoWebPlayer addon contains a buffer overflow vulnerability (CVE-2026-57274, CVSS 8.3) allowing code execution on systems if users visit attacker-controlled webpages.

How to fix or mitigate CVE-2026-57274?

24 hours: Identify all GeoWebPlayer addon deployments; issue user security advisory emphasizing social engineering risks; clarify that no public exploit code has been identified at time of analysis. 7 days: Disable addon if operationally feasible; implement network segmentation for affected systems; escalate to GeoVision support for patch timeline on CVE-2026-57274. 30 days: Establish patch readiness plan; test GeoVision-provided patches in isolated environment; prepare communication plan for end users on remediation timeline.

GeoWebPlayer CVE-2026-57274

EUVD-2026-41236 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-02 GV

GHSA-pjcq-p37h-r7c4

Buffer Overflow Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N and UI:R reflect browser-to-localhost WebSocket attack path; PR:N as the WebSocket server requires no authentication; AC:H due to required bypass of memory-safety mitigations; S:C because browser-origin attack impacts a separate local process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:56 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. One of them, connectionInfo is meant to provide the necessary details to connect to a camera. The handler associated with this command that we callhandle_connection_info contains multiple instances of string copy that can overflow. The function handle_connect_info copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits.

Buffer Overflow in password field (no key present)

AnalysisAI

Buffer overflow vulnerabilities in GeoVision's GeoWebPlayer WebSocket addon (CWE-120) allow a remote attacker to induce code execution by luring a user running the addon into visiting a malicious webpage that sends a crafted connectionInfo WebSocket command with an oversized password field to the locally-listening service. The unbounded manual byte-by-byte copy in handle_connection_info overwrites adjacent memory, potentially yielding full process compromise across all impact dimensions (C:H/I:H/A:H). Reported by Cisco Talos (TALOS-2026-2375) and acknowledged by GeoVision; no public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

GeoWebPlayer (CPE: cpe:2.3:a:geovision_inc.:geowebplayer:*:*:*:*:*:*:*:*) is a browser/software addon bundled with GeoVision surveillance platforms - marketed as 'Web Plugin' in GV-VMS documentation and 'WS Player' in GV-Cloud - that launches a local WebSocket server to extend web-based camera management functionality. The root cause (CWE-120, Buffer Copy without Checking Size of Input) resides in the handle_connection_info function, which handles the connectionInfo WebSocket command. Rather than using bounded string functions, the code employs manual byte-by-byte loops to copy attacker-controlled JSON values - including the password field - into fixed-size buffers, imposing no length checks. This is a classic stack or heap buffer overflow pattern that can corrupt adjacent memory structures and redirect execution flow. The WebSocket server accepts connections from localhost, meaning the attack path runs from a browser-rendered page through the loopback interface rather than directly from the external network.

RemediationAI

Consult the GeoVision security advisory at https://www.geovision.com.tw/cyber_security.php for vendor-released patch details - a specific fixed version was not independently confirmed from the available intelligence data (patch available per vendor advisory). Until a verified patched version is installed, apply the following compensating controls in order of priority: disable or uninstall the GeoWebPlayer addon if web-based camera management functionality is not actively required, noting this will break web interface features that depend on the local WebSocket server; restrict outbound browser access on VMS workstations to prevent users from visiting untrusted external pages, reducing drive-by WebSocket attack exposure; enforce host-based firewall rules to bind the GeoWebPlayer WebSocket server port to loopback only and block cross-origin WebSocket connections where configurable. Review Talos advisory TALOS-2026-2375 at https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375 for any additional technical mitigations published by the researcher.