# CVE-2026-57277: GeoVision GeoWebPlayer stack buffer overflow in connectionInfo handler

Source: https://junglewise.ai/threats/cve-2026-57277-geovision-geowebplayer-stack-buffer-overflow-in-connectioninfo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57277 · Severity: high · CVSS 8.3 · Published 2026-07-02

GeoWebPlayer is a browser-based plugin used to view video feeds from GeoVision security cameras and management systems. A security flaw allows an attacker to crash the software or potentially take control of the computer running the plugin by tricking a user into visiting a malicious website. This could lead to unauthorized access to surveillance data or a foothold in the local network.

Technologies: [Geovision GeoWebPlayer](https://junglewise.ai/threats/technologies/geowebplayer). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-57277 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57277 being exploited in the wild.

**How severe is CVE-2026-57277?** High severity, with a CVSS score of 8.3, published 2 July 2026.

**Which products and versions are affected?** Geovision GeoWebPlayer 1.1.1.0.

**Is there a fix for CVE-2026-57277?** A patch was published on 2026-04-28: Vendor patch release (v1.1.3.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57277 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57277?** Check whether you run Geovision GeoWebPlayer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the 'handle_connection_info' function of the GeoWebPlayer WebSocket server. The vulnerability is caused by manual byte-by-byte loops that copy attacker-controlled JSON strings into fixed-size buffers without enforcing length limits. Specifically, the 'key' field is copied into a 17-byte buffer (key_blob). An attacker can exploit this by hosting a malicious webpage that sends a specially crafted WebSocket message to the local server (localhost). Successful exploitation can lead to arbitrary code execution in the context of the plugin. The vulnerability is patched in version 1.1.3.0.

## Affected products

- GeoVision Inc. GeoWebPlayer 1.1.1.0

## Timeline

- 2026-03-25: other: Initial vendor contact
- 2026-04-21: disclosed: Vendor disclosure
- 2026-04-28: patched: Vendor patch release (v1.1.3.0)
- 2026-07-01: advisory: Public release by Talos

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GeoWebPlayer buffer overflow in ip field](https://junglewise.ai/threats/cve-2026-57278-geovision-geowebplayer-buffer-overflow-in-ip-field)
- [GeoVision GeoWebPlayer buffer overflow in password field of connectionInfo handler](https://junglewise.ai/threats/cve-2026-57276-geovision-geowebplayer-buffer-overflow-in-password-field-of)
- [GeoVision GeoWebPlayer stack buffer overflow in connectionInfo handler](https://junglewise.ai/threats/cve-2026-57275-geovision-geowebplayer-stack-buffer-overflow-in-connectioninfo)
- [GeoVision GeoWebPlayer stack buffer overflow in connectionInfo password field](https://junglewise.ai/threats/cve-2026-57274-geovision-geowebplayer-stack-buffer-overflow-in-connectioninfo)
- [GeoVision GeoWebPlayer buffer overflows in connectionInfo handler](https://junglewise.ai/threats/cve-2026-57273-geovision-geowebplayer-buffer-overflows-in-connectioninfo-handler)