GeoWebPlayer's websocket server accepts commands from localhost, including 'connectionInfo' which provides camera connection details. The handler function 'handle_connection_info' copies JSON strings into fixed-size buffers using manual byte-by-byte loops without enforcing length limits, resulting in a buffer overflow vulnerability (CWE-120). This vulnerability affects version 1.1.1.0 of GeoWebPlayer and can be exploited to cause memory corruption, potentially leading to code execution or denial of service. The CVSS 3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this buffer overflow can lead to arbitrary code execution, system crashes, or denial of service. The vulnerability compromises confidentiality, integrity, and availability of the affected GeoWebPlayer instance. Since the websocket server listens on localhost, exploitation requires local access or a way to send commands from the local machine.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the localhost interface where the websocket server listens to prevent unauthorized command injection. Monitor vendor channels for updates and apply patches promptly once released.