GeoWebPlayer CVE-2026-57275

Exploitation requires that the GeoWebPlayer / 'Web Plugin' / 'WS Player' addon is installed and its localhost WebSocket server is running (a component bundled with GeoVision GV-VMS, GV-Cloud or VMS-Cloud), and that a message using the connectionInfo command with an over-long username field reaches the handle_connection_info handler. Per the CVSS vector, exploitation is unauthenticated (PR:N) but is limited by two concrete factors: it requires user interaction (UI:R) - the victim must open attacker-controlled web content that connects to the local WebSocket - and it carries high attack complexity (AC:H), consistent with needing to win a browser-to-localhost cross-site WebSocket path and shape the overflow reliably. The WebSocket server only accepts commands originating from localhost, so the attacker must pivot through the victim's own machine (typically their browser) rather than reaching the port directly across the network.

The single provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) rates this High: no authentication (PR:N) and full CIA impact with a scope change, but tempered by high attack complexity (AC:H) and required user interaction (UI:R). Note a nuance worth flagging: the description says commands are accepted 'from localhost,' yet the vector is AV:N - these are reconciled by a cross-site WebSocket scenario where a remote web page loaded in the victim's browser connects to the local WebSocket server, which is a plausible reading but should be verified against the Talos report. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure is currently unquantified; the combination of AC:H plus UI:R and the need for a targeted browser-delivery path makes opportunistic mass exploitation unlikely, pointing toward a targeted rather than widespread threat. Overall this is a credible priority for organizations running GeoVision VMS with the plugin installed, but not an emergency-patch-tonight item absent evidence of active exploitation.

An attacker lures a user who has GeoWebPlayer running (e.g., a GV-VMS operator) into opening a crafted web page; the page opens a WebSocket to the local GeoWebPlayer server and sends a connectionInfo command whose username field is far longer than the destination buffer. The byte-by-byte copy overflows the fixed-size buffer, corrupting memory to crash the service or execute attacker-controlled code in the plugin's context. No public exploit is identified at time of analysis, and the high attack complexity plus required user interaction make this a targeted rather than spray-and-pray attack.