CVE-2026-13132 Overview
CVE-2026-13132 affects GeoWebPlayer, an addon distributed with GeoVision software including GV-VMS and GV-Cloud. The component is referred to as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud. GeoWebPlayer runs a WebSocket server that extends the functionality of GeoVision web interfaces and accepts commands from localhost.
The vulnerability resides in the setStream command handler. The handler accepts an index parameter that is used to reference internal arrays without validating the value against valid array bounds [CWE-129]. A crafted command triggers out-of-bounds array access, enabling attackers to reach critical code paths and function pointers outside the intended range.
Critical Impact
A remote attacker can coerce a victim into visiting a malicious page that issues WebSocket commands to the local GeoWebPlayer service, resulting in out-of-bounds memory access with impact to confidentiality, integrity, and availability.
Affected Products
- GeoVision GeoWebPlayer (Web Plugin) for GV-VMS
- GeoVision WS Player for GV-Cloud (VMS-Cloud)
- GeoVision software packages bundling the GeoWebPlayer addon
Discovery Timeline
- 2026-07-02 - CVE-2026-13132 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-13132
Vulnerability Analysis
GeoWebPlayer installs a local WebSocket server that browser-based GeoVision interfaces use to control streaming and playback. The server binds to localhost and accepts JSON-style commands from any page loaded in the user's browser. Multiple commands, including setStream, accept an index value that the handler uses to look up entries in internal arrays.
The setStream handler does not verify that the supplied index falls within array boundaries before dereferencing. An attacker-controlled index therefore reads or writes memory beyond the allocated array. Depending on the specific array touched, the out-of-bounds access enters critical sections, invokes function pointers, or corrupts adjacent state.
Exploitation requires a user to visit a web page while GeoWebPlayer is running on the same host. The attacker page opens a WebSocket to the local service and issues the malformed setStream command.
Root Cause
The root cause is improper validation of an array index [CWE-129]. The command dispatcher trusts caller-supplied numeric values as valid array offsets. No lower-bound or upper-bound check occurs before the index is used in pointer arithmetic against internal object arrays.
Attack Vector
The attack vector is network-adjacent through browser-mediated access to the localhost WebSocket. User interaction is required — the victim must load an attacker-controlled page. Because the WebSocket has no origin-based access control, any page can reach the service. The scope changes because a browser tab influences a separate desktop process. Successful exploitation impacts confidentiality, integrity, and availability of the GeoWebPlayer process.
No verified public exploit code is available. See the Talos Intelligence Vulnerability Report for the technical writeup.
Detection Methods for CVE-2026-13132
Indicators of Compromise
- Unexpected crashes of the GeoWebPlayer or WS Player process on hosts running GeoVision software
- Browser sessions establishing WebSocket connections to the local GeoWebPlayer port from untrusted origins
- setStream commands containing index values outside the range of currently active streams
Detection Strategies
- Inspect WebSocket traffic to the GeoWebPlayer localhost listener and flag commands with numeric index fields exceeding the expected stream count
- Correlate browser process network activity with GeoWebPlayer process crashes or restarts to surface exploitation attempts
- Monitor endpoint telemetry for anomalous child processes or memory-access faults originating from the GeoWebPlayer binary
Monitoring Recommendations
- Enable process crash and Windows Error Reporting (WER) collection on workstations running GeoVision software
- Log outbound HTTP referrers on managed browsers to identify pages that initiate localhost WebSocket sessions
- Maintain an inventory of hosts with GeoWebPlayer installed so vulnerable systems can be prioritized for patching
How to Mitigate CVE-2026-13132
Immediate Actions Required
- Identify all hosts running GeoVision products that install the GeoWebPlayer or WS Player addon
- Apply the vendor update once available from the GeoVision Cyber Security page
- Restrict browser access on workstations that also run GeoWebPlayer, and instruct users not to browse untrusted sites from those hosts
Patch Information
Refer to the GeoVision Cyber Security Overview for fixed versions and release notes. Review the Talos Intelligence Vulnerability Report for the disclosure details and technical description of the setStream index validation failure.
Workarounds
- Stop or disable the GeoWebPlayer service on hosts that do not require the browser plugin functionality
- Use host-based firewall rules to block loopback connections to the GeoWebPlayer WebSocket port from browser processes
- Configure browser policies to block WebSocket connections to localhost on managed endpoints where GeoWebPlayer is installed
# Example: block loopback access to the GeoWebPlayer WebSocket listener on Windows
# Replace <PORT> with the port used by the installed GeoWebPlayer version
netsh advfirewall firewall add rule name="Block GeoWebPlayer WS" ^
dir=in action=block protocol=TCP localport=<PORT> remoteip=127.0.0.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
