PT-2026-54624 · Geovision · Geowebplayer

Kelly Patterson + 2 · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-13131

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoWebPlayer (affected versions not specified)

Description The GeoWebPlayer addon, which functions as a websocket server for GeoVision software such as GV-VMS and GV-Cloud, contains an out-of-bounds array access flaw. The server accepts commands from localhost that utilize an index value to access arrays for critical sections and function calls. Because the index value is not properly validated for range, it can be used to access arrays outside their intended boundaries, specifically within the connectInfo command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2026-13131

Affected Products

Geowebplayer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-13131 · Security Note
• https://geovision.com.tw/cyber_security.php · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373 · Note
• https://twitter.com/VulmonFeeds/status/2072616685224222763 · Twitter Post