CVE-2026-57268

Name of the Vulnerable Software and Affected Versions GeoWebPlayer (affected versions not specified)

Description GeoWebPlayer, also known as Web Plugin in GV-VMS documentation and WS Player for VMS-Cloud, is an addon for GeoVision software that implements a websocket server to extend web-interface capabilities. The websocket server accepts commands from localhost that utilize an index value to access arrays for critical sections and function calls. A lack of range validation for the index parameter allows out-of-bounds access to multiple arrays. Specifically, when the saveVideo command is used, the index value is used to trigger and release a CriticalSection (a synchronization mechanism used to prevent multiple threads from accessing a shared resource simultaneously). The release process involves a function pointer read from an out-of-bounds memory location, which could potentially lead to arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.