Quick answers
- Is CVE-2026-13132 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13132 being exploited in the wild.
- How severe is CVE-2026-13132?
- High severity, with a CVSS score of 8.3, published 2 July 2026.
- Which products and versions are affected?
- Geovision GeoWebPlayer V1.1.1.0.
- Is there a fix for CVE-2026-13132?
- A patch was published on 2026-07-02: Vendor confirmed version 1.1.3.0 is unaffected Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13132 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-13132?
- Check whether you run Geovision GeoWebPlayer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An improper validation of array index (CWE-129) exists in the WebSocket server of GeoVision GeoWebPlayer version 1.1.1.0. The 'setStream' command accepts an 'index' parameter from a JSON message without performing bounds checking. This index is subsequently used to access arrays and retrieve function pointers for critical section operations. By supplying a specially crafted index value via a malicious webpage (requiring user interaction), an attacker can trigger an out-of-bounds read of a function pointer, leading to arbitrary code execution. The vulnerability is patched in version 1.1.3.0.
Affected products
- GeoVision Inc. GeoWebPlayer V1.1.1.0
Timeline
- 2026-07-01: disclosed: Initial disclosure by Cisco Talos
- 2026-07-02: advisory: NVD publication date
- 2026-07-02: patched: Vendor confirmed version 1.1.3.0 is unaffected