GeoWebPlayer CVE-2026-57278

Requires the GeoWebPlayer/Web Plugin (WS Player) addon to be installed and its localhost WebSocket server running on the victim host - this addon ships with GeoVision products (GV-VMS, GV-Cloud) but is a discrete component, so hosts without it are not exploitable. The specific trigger is a connectionInfo WebSocket command containing an oversized string field (e.g. ip) processed by the handle_connection_info handler. Limiting factors per the CVSS vector: user interaction is required (UI:R) - a victim must visit attacker-controlled web content that connects to the loopback WebSocket; attack complexity is High (AC:H), reflecting the effort to turn the overflow into reliable code execution rather than a crash; and while PR:N means no authentication to the WebSocket is needed, the server is loopback-bound so remote reach depends on the browser-pivot delivery rather than direct network exposure.

The vendor CVSS 3.1 base score is 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. The signals are mixed: the server accepts commands from localhost only, yet the vector is scored AV:N with UI:R and scope-change (S:C), which is consistent with a browser-pivot delivery - a victim navigating to a malicious website causes their browser to reach the loopback WebSocket, crossing a trust boundary from web content into the native process. AC:H reflects that reliably weaponizing a memory-corruption overflow (defeating stack cookies/ASLR to reach code execution vs. a crash) is non-trivial. Mitigating real-world risk: no EPSS score was provided, the CVE is not in CISA KEV, and no public POC is referenced, so there is currently no evidence of active exploitation - this looks like a research-reported issue (Cisco Talos TALOS-2026-2375) rather than a mass-exploited threat. Net: a genuine High-severity memory-safety bug requiring user interaction and non-trivial exploit engineering, warranting prompt patching but not emergency-tier response absent exploitation evidence.

An attacker lures an operator who has GeoWebPlayer running to a malicious or compromised web page; JavaScript on that page opens a WebSocket to the local GeoWebPlayer server and sends a connectionInfo command whose ip field is far longer than the destination buffer. The unbounded copy in handle_connect_info overruns the buffer, corrupting memory to crash the process or, with reliable exploitation, execute attacker-controlled code in the context of the GeoWebPlayer process. No public exploit code is identified at time of analysis.