Executive brief
GeoWebPlayer is a browser-based plugin used to view video feeds from GeoVision security cameras and management systems. A security flaw allows an attacker to crash the software or potentially take control of the computer running the plugin by tricking a user into visiting a malicious website. This could lead to unauthorized access to surveillance data or a foothold in the local network.
Technical details
A stack-based buffer overflow exists in the 'handle_connection_info' function of the GeoWebPlayer WebSocket server. The vulnerability is caused by manual byte-by-byte loops that copy attacker-controlled JSON strings into fixed-size buffers without enforcing length limits. Specifically, the 'key' field is copied into a 17-byte buffer (key_blob). An attacker can exploit this by hosting a malicious webpage that sends a specially crafted WebSocket message to the local server (localhost). Successful exploitation can lead to arbitrary code execution in the context of the plugin. The vulnerability is patched in version 1.1.3.0.
Affected products
- GeoVision Inc. GeoWebPlayer 1.1.1.0
Timeline
- 2026-03-25: other: Initial vendor contact
- 2026-04-21: disclosed: Vendor disclosure
- 2026-04-28: patched: Vendor patch release (v1.1.3.0)
- 2026-07-01: advisory: Public release by Talos