# CVE-2026-12488: GeoVision GV-VMS stack buffer overflow in GV-Cloud

Source: https://junglewise.ai/threats/cve-2026-12488-geovision-gv-vms-stack-buffer-overflow-in-gv-cloud  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-12488 · Severity: medium · CVSS 6.2 · Published 2026-06-24

A security vulnerability exists in GeoVision's video management software, which is used to manage and monitor security camera feeds. An attacker could impersonate a legitimate cloud server to send malicious commands to the software, potentially causing the system to crash or stop responding. This could lead to a temporary loss of surveillance capabilities and security monitoring.

Technologies: [Geovision GV-VMS](https://junglewise.ai/threats/technologies/gv-vms). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-12488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12488 being exploited in the wild.

**How severe is CVE-2026-12488?** Medium severity, with a CVSS score of 6.2, published 24 June 2026.

**Which products and versions are affected?** Geovision GV-VMS 20.0.2.

**Is there a fix for CVE-2026-12488?** A patch was published on 2025-12-02: Vendor released version 20.1.0.0 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12488 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12488?** Check whether you run Geovision GV-VMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the GvRelayProxy.dll component of GeoVision GV-VMS V20. The vulnerability is located in the GvRelayProxyServerThreadProc function, which fails to validate the 'size' field in the header of incoming network messages before reading data into a fixed-size stack buffer (4072 bytes). An attacker can exploit this by impersonating the 'relay.vsm.mygvcloud.com' server via DNS poisoning or Man-in-the-Middle (MitM) attacks, as the software fails to properly verify the server's identity during the handshake. Successful exploitation can lead to a denial of service (DoS) via a stack cookie failure or potentially remote code execution (RCE) if the attacker can bypass stack protections. The issue is addressed in version 20.1.0.0.

## Affected products

- GeoVision GV-VMS V20 20.0.2

## Timeline

- 2025-12-02: patched: Vendor released version 20.1.0.0 to address the issue.
- 2026-05-10: disclosed: Vulnerability disclosed to the vendor.
- 2026-06-23: advisory: Cisco Talos published detailed vulnerability report.
- 2026-06-24: disclosed: CVE-2026-12488 published.

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2411](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2411)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A…](https://junglewise.ai/threats/cve-2026-7372-a-stack-overflow-vulnerability-exists-in-the-webcam-server-login)
- [GeoVision GV-VMS stack overflow in WebCam Server Login](https://junglewise.ai/threats/cve-2026-42370-geovision-gv-vms-stack-overflow-in-webcam-server-login)
- [GeoVision GV-VMS stack overflow in gvapi endpoint](https://junglewise.ai/threats/cve-2026-42369-geovision-gv-vms-stack-overflow-in-gvapi-endpoint)