Stack Overflow Vulnerability in GeoVision GV-VMS Login Functionality
CVE-2026-7372

9CRITICAL

Key Information:

Vendor

Geovision Inc.

Status
Gv-vms V20.0.2
Vendor
CVE Published:
4 May 2026

What is CVE-2026-7372?

A stack overflow vulnerability has been identified in the login functionality of GeoVision GV-VMS V20 20.0.2. This vulnerability arises from an inadequate size constraint during the extraction of username and password parameters from HTTP requests using the sscanf function. If an attacker sends a specially crafted HTTP request that exceeds the expected size of 40 characters for either parameter, a stack overflow occurs. This condition can allow the attacker to execute arbitrary code with the highest privileges on the affected system. To mitigate this risk, it is essential for users to update their systems and implement strong input validation measures.

Affected Version(s)

GV-VMS V20.0.2 Windows 20.0.2

GV-VMS V20.0.2 Windows 21.0.0

References

https://www.geovision.com.tw/cyber_security.php
vendor-advisory
https://talosintelligence.com/vulnerability_reports/
third-party-advisory

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Laulheret of Cisco Talos.
Kelly Patterson of Cisco Talos.
Martin Zeiser of Cisco Talos.
.