# CVE-2026-42369: GeoVision GV-VMS stack overflow in gvapi endpoint

Source: https://junglewise.ai/threats/cve-2026-42369-geovision-gv-vms-stack-overflow-in-gvapi-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-42369 · Severity: critical · CVSS 10 · Published 2026-05-04

GeoVision GV-VMS is a video management system used to monitor surveillance camera feeds and manage security hardware. A critical vulnerability in its remote access feature allows an attacker to take complete control of the server hosting the software. This could lead to the total loss of surveillance data, unauthorized access to live camera feeds, and a foothold for further attacks on the corporate network.

Technologies: [Geovision GV-VMS](https://junglewise.ai/threats/technologies/gv-vms). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-42369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42369 being exploited in the wild.

**How severe is CVE-2026-42369?** Critical severity, with a CVSS score of 10, published 4 May 2026.

**Which products and versions are affected?** Geovision GV-VMS V20.

**Is there a fix for CVE-2026-42369?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42369 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42369?** Check whether you run Geovision GV-VMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the 'gvapi' endpoint of GeoVision GV-VMS V20 when the WebCam Server feature is enabled. The vulnerability is located in the handling of the HTTP Authorization header, which supports Basic and Digest authentication. A base64-decoded string is copied into a fixed-size 256-byte stack buffer without adequate bounds checking. Because the web server component is compiled without Address Space Layout Randomization (ASLR), an unauthenticated remote attacker can reliably exploit this overflow to overwrite the return address and achieve arbitrary code execution with SYSTEM privileges.

## Affected products

- GeoVision GV-VMS V20

## Timeline

- 2026-04-27: advisory: Vendor published security advisory GV-VMS-2026-04-01
- 2026-05-04: disclosed: NVD publication date

## References

- [https://https//talosintelligence.com/vulnerability_reports/](https://https//talosintelligence.com/vulnerability_reports/)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GV-VMS stack buffer overflow in GV-Cloud](https://junglewise.ai/threats/cve-2026-12488-geovision-gv-vms-stack-buffer-overflow-in-gv-cloud)
- [A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A…](https://junglewise.ai/threats/cve-2026-7372-a-stack-overflow-vulnerability-exists-in-the-webcam-server-login)
- [GeoVision GV-VMS stack overflow in WebCam Server Login](https://junglewise.ai/threats/cve-2026-42370-geovision-gv-vms-stack-overflow-in-webcam-server-login)