CVE-2026-57271
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The GeoWebPlayer addon (also known as Web Plugin or WS Player) for GeoVision software (GV-VMS, GV-Cloud) contains an out-of-bounds read vulnerability in the handling of the 'pause' command. This could lead to unexpected behavior or potential security compromise.
Risk Assessment
The risk for the organization includes the possibility of remotely disrupting GeoVision-based video surveillance systems, potentially resulting in loss of access to live feeds or recordings.
Recommendation
It is recommended to immediately update the GeoWebPlayer addon to the latest version available from the vendor and restrict access to the websocket server to trusted networks only.
Other vulnerabilities in GeoWebPlayer
See all- CVE-2026-57278High
The GeoWebPlayer (Web Plugin/WS Player) addon for GeoVision software contains a buffer overflow vulnerability in the handler for the `connectionInfo` command. An attacker on localhost can send crafted JSON data that is copied into fixed-size buffers without length checks, causing overflow.
- CVE-2026-57277High
The GeoWebPlayer (Web Plugin/WS Player) addon for GeoVision software (GV-VMS, GV-Cloud) contains a buffer overflow vulnerability in the function handling the `connectionInfo` command. An attacker from localhost can send crafted JSON data that is copied into fixed-size buffers without length checking, causing overflow.
- CVE-2026-57276High
A buffer overflow vulnerability in GeoWebPlayer (Web Plugin) allows an attacker from localhost to execute code by sending a crafted WebSocket request with an overly long 'password' field. The handle_connection_info function copies data into fixed-size buffers without length checks, causing overflow.
- CVE-2026-57275High
The GeoWebPlayer addon (Web Plugin/WS Player) for GeoVision software (GV-VMS, GV-Cloud) contains a buffer overflow vulnerability in the handle_connection_info function. An attacker on localhost can send a crafted websocket request with a username field that copies data into a fixed-size buffer without length checking.
- CVE-2026-57274High
The GeoWebPlayer addon (Web Plugin/WS Player) for GeoVision software (GV-VMS, GV-Cloud) contains a buffer overflow vulnerability in the handle_connection_info function. An attacker from localhost can send a crafted JSON request with a password field that is copied into a fixed-size buffer without length checking, causing overflow.
- CVE-2026-57273High
The GeoWebPlayer addon (Web Plugin/WS Player) for GeoVision software contains a buffer overflow vulnerability in the handle_connection_info function. An attacker from localhost can send a crafted JSON request that overflows a buffer in the username field due to manual byte-by-byte copying without length checks.
- CVE-2026-57272High
A vulnerability in GeoWebPlayer (Web Plugin) allows out-of-bounds array access due to improper index validation in WebSocket commands. An attacker from localhost can exploit this to perform unauthorized operations.
- CVE-2026-57270High
A vulnerability in GeoWebPlayer (Web Plugin/WS Player) for GeoVision software (GV-VMS, GV-Cloud) stems from missing validation of the `index` value in commands received from localhost. This allows out-of-bounds array access, potentially leading to uncontrolled behavior.
- CVE-2026-57269High
A vulnerability in GeoWebPlayer (Web Plugin/WS Player) for GeoVision software (GV-VMS, GV-Cloud) stems from missing validation of the 'index' value in the 'disconnect' command of the WebSocket server. This allows out-of-bounds array access, potentially leading to unexpected behavior or control flow hijacking.
- CVE-2026-57268High
The GeoWebPlayer addon (Web Plugin/WS Player) for GeoVision software (GV-VMS, GV-Cloud) contains an out-of-bounds read vulnerability in the `saveVideo` command. The index from the WebSocket message is not validated, allowing access to critical sections and function pointers beyond array bounds, potentially leading to arbitrary code execution.
Original NVD description (English source)
GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. #### pause command index-out-of-bound