Quick answers
- Is CVE-2026-57276 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57276 being exploited in the wild.
- How severe is CVE-2026-57276?
- High severity, with a CVSS score of 8.3, published 2 July 2026.
- Which products and versions are affected?
- Geovision GeoWebPlayer 1.1.1.0.
- Is there a fix for CVE-2026-57276?
- A patch was published on 2026-04-28: Vendor patch release (v1.1.3.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57276 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-57276?
- Check whether you run Geovision GeoWebPlayer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow exists in GeoVision GeoWebPlayer version 1.1.1.0 within the WebSocket server component. The vulnerability is located in the `handle_connection_info` function, which processes the `connectionInfo` command. When a 'key' variable is provided in the JSON payload, the application copies the 'password' field into a fixed-size 128-byte buffer (`password_enc`) using a manual byte-by-byte loop without bounds checking. An attacker can exploit this by hosting a malicious webpage that sends a specially crafted WebSocket message to the local GeoWebPlayer service, leading to arbitrary code execution. The vendor has released version 1.1.3.0 to address this issue.
Affected products
- GeoVision Inc. GeoWebPlayer 1.1.1.0
Timeline
- 2026-03-25: other: Initial vendor contact
- 2026-04-21: disclosed: Vendor disclosure
- 2026-04-28: patched: Vendor patch release (v1.1.3.0)
- 2026-07-01: advisory: Public release by Cisco Talos
- 2026-07-02: advisory: NVD publication