CVE-2026-13131 describes an improper validation of array index (CWE-129) vulnerability in GeoVision Inc.'s GeoWebPlayer (version 1.1.1.0). The GeoWebPlayer websocket server accepts commands from localhost that include an index parameter used to access various arrays. The lack of proper bounds checking on this index allows out-of-bounds array access, which can lead to critical security consequences including unauthorized memory access or code execution. The vulnerability affects the GeoWebPlayer addon used with GeoVision software such as GV-VMS and GV-Cloud. The CVSS 3.1 base score is 8.3, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability can lead to out-of-bounds memory access, potentially allowing an attacker to execute arbitrary code, escalate privileges, or cause denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. Since the websocket server accepts commands only from localhost, exploitation requires local access or a mechanism to send commands from the local machine. The high CVSS score indicates a significant security risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the localhost interface hosting the GeoWebPlayer websocket server to trusted users only. Monitor for updates from GeoVision Inc. regarding patches or mitigations. Avoid exposing the vulnerable component to untrusted local users or processes.