# CVE-2026-57278: GeoVision GeoWebPlayer buffer overflow in ip field

Source: https://junglewise.ai/threats/cve-2026-57278-geovision-geowebplayer-buffer-overflow-in-ip-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57278 · Severity: high · CVSS 8.3 · Published 2026-07-02

GeoVision GeoWebPlayer, a plugin used to facilitate web-based video management and camera viewing, contains a security vulnerability in how it handles connection information. An attacker could exploit this by tricking a user into visiting a malicious webpage, potentially allowing the attacker to take control of the user's system or disrupt video surveillance operations. This affects organizations using GeoVision VMS or Cloud solutions that rely on this web plugin for camera connectivity.

Technologies: [Geovision GeoWebPlayer](https://junglewise.ai/threats/technologies/geowebplayer). Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-57278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57278 being exploited in the wild.

**How severe is CVE-2026-57278?** High severity, with a CVSS score of 8.3, published 2 July 2026.

**Which products and versions are affected?** Geovision GeoWebPlayer V1.1.1.0.

**Is there a fix for CVE-2026-57278?** A patch was published on 2026-04-28: Vendor patch release (V1.1.3.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57278 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57278?** Check whether you run Geovision GeoWebPlayer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

GeoVision GeoWebPlayer version 1.1.1.0 contains a stack-based buffer overflow vulnerability (CWE-120) within the 'handle_connection_info' function of its WebSocket server. The vulnerability arises when the server processes a 'connectionInfo' command; it copies the 'ip' field from an attacker-controlled JSON string into a fixed-size 256-byte buffer (conn_info.ip_or_host) using a manual byte-by-byte loop without length validation. While the WebSocket server listens on localhost, the attack vector is remote via a malicious webpage (User Interaction required) that communicates with the local WebSocket server. Successful exploitation can lead to arbitrary code execution with the privileges of the GeoWebPlayer process. The vendor has released version 1.1.3.0 to address this issue.

## Affected products

- GeoVision Inc. GeoWebPlayer V1.1.1.0

## Timeline

- 2026-03-25: other: Initial vendor contact
- 2026-04-21: disclosed: Vendor disclosure
- 2026-04-28: patched: Vendor patch release (V1.1.3.0)
- 2026-07-01: advisory: Public release by Talos
- 2026-07-02: advisory: NVD publication

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375](https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375)
- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)

## Related threats

- [GeoVision GeoWebPlayer stack buffer overflow in connectionInfo handler](https://junglewise.ai/threats/cve-2026-57277-geovision-geowebplayer-stack-buffer-overflow-in-connectioninfo)
- [GeoVision GeoWebPlayer buffer overflow in password field of connectionInfo handler](https://junglewise.ai/threats/cve-2026-57276-geovision-geowebplayer-buffer-overflow-in-password-field-of)
- [GeoVision GeoWebPlayer stack buffer overflow in connectionInfo handler](https://junglewise.ai/threats/cve-2026-57275-geovision-geowebplayer-stack-buffer-overflow-in-connectioninfo)
- [GeoVision GeoWebPlayer stack buffer overflow in connectionInfo password field](https://junglewise.ai/threats/cve-2026-57274-geovision-geowebplayer-stack-buffer-overflow-in-connectioninfo)
- [GeoVision GeoWebPlayer buffer overflows in connectionInfo handler](https://junglewise.ai/threats/cve-2026-57273-geovision-geowebplayer-buffer-overflows-in-connectioninfo-handler)