This vulnerability (CVE-2026-18755) involves an unquoted search path or element (CWE-428) in GeoVision GV-ASManager 6.3.0. A local attacker who can write to an unsafe directory in the application's DLL search path can insert a crafted DLL. When GV-ASManager loads libraries, it may load the malicious DLL instead of the legitimate one, resulting in arbitrary code execution with the process's privileges. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the GV-ASManager process, potentially leading to full system compromise depending on those privileges. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict write permissions to directories in the GV-ASManager DLL search path to trusted users only to prevent unauthorized DLL insertion.