Stack Overflow Vulnerability in Geovision Video Monitoring Software
CVE-2026-42369

10CRITICAL

Key Information:

Vendor

Geovision Inc.

Status
Gv-vms V20.0.2
Vendor
CVE Published:
4 May 2026

What is CVE-2026-42369?

The GV-VMS V20 video monitoring software, used for managing surveillance feeds, has a stack overflow vulnerability due to unbound copying of a Base64 decoded string. This flaw arises when an attacker can control the size of the input beyond 256 characters, leading to a stack buffer overflow, which can be exploited due to the absence of Address Space Layout Randomization (ASLR). If the 'WebCam Server' feature is enabled for remote access, the risk is elevated, allowing potential unauthorized access and full code execution on the machine running the service.

Affected Version(s)

GV-VMS V20.0.2 Windows V20.0.2

GV-VMS V20.0.2 Windows V21.0.0

References

https://www.geovision.com.tw/cyber_security.php
vendor-advisorythird-party-advisory
https://https://talosintelligence.com/vulnerability_reports/

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Laulheret of Cisco Talos.
Kelly Patterson of Cisco Talos.
Martin Zeiser of Cisco Talos.
.