GeoWebPlayer (also known as Web Plugin or WS Player) is an addon for GeoVision software that runs a websocket server accepting commands from localhost. The 'handle_connection_info' function processes the 'connectionInfo' command by copying JSON strings into fixed-size buffers using manual byte-by-byte loops without proper length checks. This results in a classic buffer overflow (CWE-120) vulnerability in the 'ip' field, allowing potential memory corruption. The affected version is exactly 1.1.1.0. The CVSS 3.1 base score is 8.3, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation of this buffer overflow can lead to arbitrary code execution, denial of service, or system compromise with full impact on confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network but requires user interaction and has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the localhost websocket server and monitor for suspicious activity related to the 'connectionInfo' command. Avoid running the vulnerable version 1.1.1.0 in untrusted environments.