CVE-2026-13131 Overview
CVE-2026-13131 is an out-of-bounds array access vulnerability in GeoVision GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud. The addon runs a local WebSocket server that extends GeoVision web interfaces including GV-VMS and GV-Cloud. The server accepts commands from localhost that include an index parameter used to access internal arrays. The software fails to validate the range of this index value, allowing attackers to read or write outside allocated array bounds. The connectInfo command is one of several affected command handlers. Successful exploitation requires user interaction, such as visiting an attacker-controlled web page that issues crafted WebSocket requests.
Critical Impact
An attacker who convinces a user to visit a malicious page can trigger out-of-bounds array access in the local WebSocket server, potentially resulting in memory corruption, confidentiality loss, and disruption of GeoVision surveillance components.
Affected Products
- GeoVision GeoWebPlayer (Web Plugin addon)
- GeoVision GV-VMS software with Web Plugin installed
- GeoVision GV-Cloud / VMS-Cloud with WS Player installed
Discovery Timeline
- 2026-07-02 - CVE-2026-13131 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-13131
Vulnerability Analysis
GeoWebPlayer installs a local WebSocket server that brokers commands between GeoVision web interfaces and the underlying software. The server exposes multiple command handlers accessible from localhost. Several handlers, including connectInfo, accept an index field from the client. The handler uses this index to look up entries in internal arrays that guard critical sections and dispatch function calls.
The root weakness is classified as [CWE-129] Improper Validation of Array Index. The handler does not verify that index falls within the valid bounds of the target array before dereferencing it. An attacker who controls the value can force reads or writes past the end of the array, corrupting adjacent memory or invoking unintended function pointers.
Because the WebSocket endpoint listens on localhost, direct network access is not required. However, browsers running on the same host permit cross-origin WebSocket connections, so a user visiting a malicious page can trigger the vulnerable command remotely through the browser.
Root Cause
Command dispatchers in the WebSocket server trust attacker-supplied index values and use them directly as array subscripts. Missing bounds validation on the connectInfo command and related handlers allows the index to reference memory outside the intended array.
Attack Vector
Exploitation proceeds through the browser. An attacker hosts a page containing JavaScript that opens a WebSocket to the local GeoWebPlayer port and sends a connectInfo message with an out-of-range index value. When the victim visits the page, the server processes the crafted command and performs the out-of-bounds access. See the Talos Intelligence Vulnerability Report for the full technical description.
Detection Methods for CVE-2026-13131
Indicators of Compromise
- Unexpected WebSocket connections to the GeoWebPlayer local listener from browser processes rendering untrusted origins.
- Crash events or abnormal termination of GeoWebPlayer, GV-VMS, or related GeoVision processes following web browsing activity.
- WebSocket frames containing connectInfo commands with unusually large or negative index values.
Detection Strategies
- Monitor GeoVision host processes for exception events, access violations, and unexpected restarts of the WebSocket server component.
- Inspect endpoint telemetry for browser child processes initiating loopback WebSocket sessions to GeoWebPlayer ports shortly after navigation events.
- Correlate browser history with process crash reports to identify pages that triggered instability in GeoVision components.
Monitoring Recommendations
- Enable process and network telemetry on hosts running GV-VMS, GV-Cloud, and other GeoVision products with the Web Plugin installed.
- Alert on repeated malformed WebSocket payloads sent to loopback ports associated with GeoWebPlayer.
- Track patch state for GeoVision components across the fleet using software inventory tooling.
How to Mitigate CVE-2026-13131
Immediate Actions Required
- Consult the GeoVision Cyber Security Resource and apply the vendor-supplied update for GeoWebPlayer as soon as it is available.
- Restrict browsing from hosts that run GeoVision surveillance software to trusted management sites only.
- Uninstall the Web Plugin / WS Player on systems that do not require the browser-based interfaces.
Patch Information
GeoVision publishes security updates through its Cyber Security page. Administrators should verify the installed GeoWebPlayer version against the fixed release identified in the vendor advisory and the Talos report TALOS-2026-2373.
Workarounds
- Stop and disable the GeoWebPlayer WebSocket service when browser-based access to GeoVision interfaces is not needed.
- Block outbound browser connections to the GeoWebPlayer loopback port using a host firewall rule where feasible.
- Segment operator workstations from general-purpose web browsing to reduce the chance of user interaction with a malicious page.
# Configuration example: block browser access to the local GeoWebPlayer listener
# Replace <PORT> with the port used by GeoWebPlayer on the host
netsh advfirewall firewall add rule name="Block GeoWebPlayer loopback" ^
dir=out action=block protocol=TCP remoteip=127.0.0.1 remoteport=<PORT>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
