PT-2026-54870 · Geovision · Geowebplayer

Kelly Patterson + 2 · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-57265

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoWebPlayer (affected versions not specified)

Description GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that establishes a websocket server to enhance web-interface capabilities. The websocket server accepts commands from localhost that utilize an index value to access arrays for critical sections and function calls. Because the index value is not validated for a correct range, it can be used to perform out-of-bounds reads on multiple arrays, specifically within the audio command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2026-57265

Affected Products

Geowebplayer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-57265 · Security Note
• https://geovision.com.tw/cyber_security.php · Vendor Advisory
• https://t.me/cveNotify/184307 · Telegram Post
• https://t.me/cveNotify/184743 · Telegram Post
• https://t.me/CVEtracker/58653 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373 · Note