CVE-2026-57267: GeoWebPlayer Out-of-Bounds Vulnerability

CVE-2026-57267 Overview

CVE-2026-57267 affects GeoVision GeoWebPlayer, an addon also referred to as "Web Plugin" in GV-VMS documentation and "WS Player" in VMS-Cloud. The component installs alongside GeoVision software such as GV-VMS and GV-Cloud and runs a local WebSocket server that extends browser-based interfaces. The server accepts commands from localhost, including a snapshot command that consumes an attacker-controlled index value. The addon fails to validate that index falls within a valid range before using it to reference internal arrays. The result is an out-of-bounds array access [CWE-129] that can be triggered by a user who visits a crafted web page while the plugin runs.

Critical Impact
A remote attacker who convinces a user to load a malicious page can reach the local WebSocket server and trigger out-of-bounds array access affecting confidentiality, integrity, and availability across a changed security scope.

Affected Products

GeoVision GeoWebPlayer (Web Plugin) shipped with GV-VMS
GeoVision WS Player shipped with GV-Cloud / VMS-Cloud
GeoVision web interfaces that depend on the local WebSocket addon

Discovery Timeline

2026-07-02 - CVE-2026-57267 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57267

Vulnerability Analysis

GeoWebPlayer launches a WebSocket server bound to localhost. The server exposes commands that back the JavaScript features of GeoVision web consoles, including live view, playback, and snapshot operations. Each command handler dispatches on message fields and reads an index value that selects an entry from internal arrays managing sessions, decoders, and rendering contexts.

The snapshot command handler illustrates the pattern. It reads index from the message and uses it directly to index a fixed-size array without a range check. Supplying a value larger than the array bound, or a negative value, causes the handler to read or write memory outside the intended object. Attackers can influence surrounding heap or stack contents to corrupt state used by later WebSocket operations. Because the same missing validation is present across multiple commands, the primitive is repeatable and composable within a single browser session.

Root Cause

The root cause is improper validation of an array index [CWE-129]. Command handlers trust the index field from client messages and never compare it against the length of the target array before dereferencing. Deployment as a localhost service does not compensate, because any origin loaded in the user's browser can open a WebSocket to ws://127.0.0.1 and issue commands.

Attack Vector

Exploitation requires user interaction: the victim must load an attacker-controlled page in a browser on a host where GeoWebPlayer is installed and running. The page opens a WebSocket to the local addon and sends a crafted snapshot message with an out-of-range index. The attack crosses the browser sandbox into the plugin process, which is why the CVSS scope is marked as changed. See the Talos Intelligence Vulnerability Report for the specific message format and offsets.

Detection Methods for CVE-2026-57267

Indicators of Compromise

Unexpected WebSocket connections from browser processes to 127.0.0.1 on the port used by GeoWebPlayer / WS Player.
GeoWebPlayer process crashes, hangs, or unexpected restarts on hosts running GV-VMS or GV-Cloud clients.
Outbound browser connections to unknown domains immediately before local WebSocket traffic to the plugin.

Detection Strategies

Inspect endpoint telemetry for browser child processes initiating loopback WebSocket traffic to GeoVision plugin ports outside normal use of the GeoVision console.
Alert on crash dumps, Windows Error Reporting entries, or watchdog restarts associated with the GeoWebPlayer binary.
Correlate web proxy logs showing visits to untrusted pages with subsequent loopback activity to the addon.

Monitoring Recommendations

Track installed versions of GeoWebPlayer, Web Plugin, and WS Player across the fleet and flag hosts running versions predating the vendor fix.
Monitor GeoVision advisories at GeoVision Cyber Security Overview for updated builds referencing TALOS-2026-2373.
Baseline expected WebSocket destinations for the plugin and alert on anomalous message volume or malformed frames.

How to Mitigate CVE-2026-57267

Immediate Actions Required

Inventory hosts with GeoWebPlayer, Web Plugin, or WS Player installed and identify which GeoVision products depend on the addon.
Restrict browser access to untrusted sites on workstations that run the plugin until a patched version is deployed.
Uninstall the addon on hosts that do not require the browser-based GeoVision console.

Patch Information

GeoVision has not published a fixed version reference in the NVD entry at the time of publication. Consult the Talos Intelligence Vulnerability Report and the GeoVision Cyber Security Overview for the latest patched builds and apply them once available.

Workarounds

Stop and disable the GeoWebPlayer WebSocket service when the browser interface is not in active use.
Use host firewall rules to block non-GeoVision processes from connecting to the plugin's loopback port, or restrict the plugin to run only under a dedicated browser profile.
Enforce browser policies that block scripts and WebSocket connections on untrusted origins for users who must keep the addon installed.

bash

# Example: block loopback access to the GeoWebPlayer port from all processes
# except an allow-listed browser executable (Windows, adjust port as needed)
netsh advfirewall firewall add rule name="Block GeoWebPlayer loopback" ^
  dir=in action=block protocol=TCP localip=127.0.0.1 localport=<plugin_port>