What is the CVSS score of CVE-2026-57276?

CVE-2026-57276 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GeoWebPlayer are affected by CVE-2026-57276?

GeoVision surveillance products (GV-VMS, GV-Cloud) contain a remote code execution vulnerability in their bundled browser plugin that requires users to visit a malicious website to be exploited,…

How to fix or mitigate CVE-2026-57276?

Within 24 hours: Inventory all systems running GeoVision GV-VMS or GV-Cloud and assess user web browsing exposure. Within 7 days: Disable GeoWebPlayer plugin where operationally feasible; if operations require the plugin, implement browser isolation, Content Security Policy restrictions, and network segmentation of affected systems. Within 30 days: Establish daily monitoring of GeoVision vendor advisories for patch availability; develop and test deployment procedures for when patches release; evaluate alternative surveillance solutions without vulnerable components.

GeoWebPlayer CVE-2026-57276

EUVD-2026-41238 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-02 GV

GHSA-m39x-xw5g-mc76

Buffer Overflow Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote page drives the localhost WebSocket (AV:N) with no auth (PR:N) but needs victim browsing (UI:R) and reliable overflow (AC:H); payload crosses into a separate process (S:C) yielding full RCE.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:55 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. One of them, connectionInfo is meant to provide the necessary details to connect to a camera. The handler associated with this command that we callhandle_connection_info contains multiple instances of string copy that can overflow. The function handle_connect_info copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits.

Buffer Overflow in password field (key present)

AnalysisAI

Remote code execution in GeoVision GeoWebPlayer (the browser-facing 'Web Plugin'/'WS Player' addon bundled with GV-VMS, GV-Cloud and related products) is possible because the local WebSocket server's connectionInfo handler copies attacker-controlled JSON fields into fixed-size buffers with unchecked byte-by-byte loops. A remote attacker who lures a user to a malicious web page can drive the victim's browser to send an oversized password field to the localhost WebSocket, overflowing the buffer and achieving code execution (CVSS 8.3). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

GeoWebPlayer runs a local WebSocket server that bridges GeoVision's web interfaces to native surveillance/VMS functionality, accepting JSON command messages such as connectionInfo that carry camera connection details. The root cause is CWE-120 (Buffer Copy without Checking Size of Input, 'classic buffer overflow'): the handle_connect_info routine copies JSON string values, including the password field, into fixed-length buffers using manual character-copy loops that never enforce a maximum length, so an over-long string writes past the buffer boundary. The affected component is identified by CPE cpe:2.3:a:geovision_inc.:geowebplayer:* across all versions listed, with no upper bound specified.

RemediationAI

No exact vendor-released fix version was identified in the available data; consult the GeoVision cyber security advisory at https://www.geovision.com.tw/cyber_security.php and Talos report TALOS-2026-2375 (https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375) for a patched build and apply it once published. As compensating controls until patched: uninstall or disable the GeoWebPlayer/Web Plugin addon on hosts that do not require the web interface (trade-off: browser-based camera viewing features stop working); restrict which sites can reach the local WebSocket using browser or host firewall rules and a strict site allowlist so only trusted GeoVision management URLs are used (trade-off: legitimate cloud interfaces may need explicit whitelisting); and instruct operators not to browse untrusted sites on machines running the addon, since exploitation requires the victim's browser to open the malicious connection.