Websocket Buffer Overflow in GeoWebPlayer by GeoVision
CVE-2026-57274

8.3HIGH

Key Information:

Vendor

Geovision Inc.

Status
Geowebplayer
Vendor
CVE Published:
2 July 2026

What is CVE-2026-57274?

The GeoWebPlayer, part of GeoVision’s suite of software solutions, includes a websocket server that enhances web interface functionalities. A security flaw exists in the 'handle_connection_info' function, which processes commands from localhost. This flaw allows for unchecked copying of attacker-controlled JSON strings into fixed-size buffers. Exploitation of this vulnerability can result in unexpected program behavior or system compromise due to buffer overflow conditions, highlighting the importance of rigorous input validation to prevent such issues.

Affected Version(s)

GeoWebPlayer Windows V1.1.1.0

GeoWebPlayer Windows V1.1.3.0

References

https://www.geovision.com.tw/cyber_security.php
vendor-advisory
https://talosintelligence.com/vulnerability_reports/TALOS...
third-party-advisory

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Laulheret of Cisco Talos
Kelly Patterson of Cisco Talos
Robert Sherwin of Cisco Talos
.