What is the CVSS score of EUVD-2026-41243?

EUVD-2026-41243 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of GeoVision GeoWebPlayer are affected by EUVD-2026-41243?

GeoVision's GeoWebPlayer and related video management system components contain a memory corruption vulnerability (CVSS 8.3) exploitable through web browser interaction.

How to fix or mitigate EUVD-2026-41243?

Within 24 hours: identify all GeoWebPlayer, Web Plugin, and WS Player instances across GV-VMS and VMS-Cloud systems. Within 7 days: contact GeoVision support to confirm patch availability timeline and assess risk to production surveillance systems. Within 30 days: apply vendor patch when released, or implement network-based compensating controls to restrict vector.

GeoVision GeoWebPlayer EUVD-2026-41243

| CVE-2026-13132 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-02 GV

GHSA-hg87-2hf8-7633

Information Disclosure Geowebplayer Geovision Inc

8.3

CVSS 3.1 · Vendor: GV

Severity by source

Vendor (GV) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Browser-pivot to a localhost service gives AV:N/S:C but needs a crafted page and user visit (AC:H, UI:R, PR:N); info-disclosure is the confirmed C:H impact while OOB corruption yields only inferred low integrity/availability effects.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GV).

CVSS VectorVendor: GV

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 03:46 vuln.today

DescriptionCVE.org

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

The Websocket server can accept various commands coming from localhost. Many of the commands will take an index value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the index value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.

setStream command index-out-of-bound

AnalysisAI

Out-of-bounds array access in GeoVision's GeoWebPlayer (also branded 'Web Plugin' in GV-VMS and 'WS Player' in VMS-Cloud) lets an attacker abuse the addon's localhost WebSocket server via a crafted 'setStream' command whose attacker-controlled 'index' is used to index arrays without range validation (CWE-129), enabling memory disclosure and possible corruption. Because a victim's browser can be steered into connecting to the local WebSocket service, the vendor rates this AV:N/UI:R (CVSS 8.3) - a remote web page can pivot to the local service after the user visits it. No public exploit is identified at time of analysis and it is not in CISA KEV, so this is not confirmed as actively exploited.

Technical ContextAI

GeoWebPlayer is an optional addon bundled with GeoVision surveillance/VMS products (GV-VMS, GV-Cloud) that runs a local WebSocket server to extend the vendor's browser-based interfaces. Those interfaces send commands to the WebSocket endpoint on localhost; several commands, including setStream, carry an 'index' parameter that the server uses to look up entries in internal arrays for entering critical sections and dispatching function calls. The root cause is CWE-129 (Improper Validation of Array Index): the index is trusted without bounds checking, so an out-of-range value reads or writes memory outside the intended array. The single affected product per CPE is cpe:2.3:a:geovision_inc.:geowebplayer, matching all versions (*).

RemediationAI

Consult the GeoVision advisory (https://www.geovision.com.tw/cyber_security.php) and apply the patched GeoWebPlayer/Web Plugin/WS Player build for your GeoVision product; an exact fixed version is not specified in the available data, so confirm the release number with the vendor advisory before deploying. If a patched build is not yet available, reduce exposure by uninstalling or disabling the GeoWebPlayer addon where the browser-based streaming features are not required (trade-off: web interfaces that depend on the WebSocket bridge may lose functionality), and restrict which web origins users browse from since the attack requires the victim's browser to reach the local WebSocket server. As a browser-side control, avoid visiting untrusted sites in the same session used for the GeoVision web interface, and consider host-based firewall rules or loopback-binding hardening to limit connections to the local WebSocket port to trusted local clients only.