CVE-2026-16519: GeoVision GV-IP Device Utility DLL hijacking

CVE-2026-16519 · Severity: high · CVSS 7.3 · Published 2026-07-24

A security vulnerability exists in the GeoVision GV-IP Device Utility, a desktop application used to manage and configure GeoVision IP cameras and surveillance devices. A local attacker can trick the application into running malicious code by placing a specially crafted file in a specific folder on the computer. If successful, this could allow the attacker to gain full control over the system, potentially leading to data theft or disruption of the surveillance network.

Technologies: Geovision GV-IP Device Utility. Vendors: Geovision.

Quick answers

Is CVE-2026-16519 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16519 being exploited in the wild.
How severe is CVE-2026-16519?
High severity, with a CVSS score of 7.3, published 24 July 2026.
Which products and versions are affected?
Geovision GV-IP Device Utility 9.0.7.0.
Is there a fix for CVE-2026-16519?
A patch was published on 2026-07-24: Fixed in version 9.0.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16519 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-16519?
Check whether you run Geovision GV-IP Device Utility at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A DLL hijacking vulnerability (CWE-427: Uncontrolled Search Path Element) exists in the GeoVision GV-IP Device Utility version 9.0.7.0. The application attempts to load one or more dynamic-link libraries (DLLs) using an unsafe search path. A local attacker with low privileges can exploit this by placing a malicious DLL in a directory that is searched before the legitimate system or application directories. Execution occurs when a user launches the application, leading to arbitrary code execution with the privileges of the application user. GeoVision has released version 9.0.8.0 to address this issue.

Affected products

  • GeoVision Inc. GV-IP Device Utility 9.0.7.0

Timeline

  • 2026-07-24: disclosed
  • 2026-07-24: advisory
  • 2026-07-24: patched: Fixed in version 9.0.8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.