GeoWebPlayer's websocket server accepts commands from localhost, including 'connectionInfo' which provides camera connection details. The handler function 'handle_connection_info' performs manual byte-by-byte copying of JSON strings into fixed-size buffers without enforcing length limits, leading to a classic buffer overflow vulnerability (CWE-120). This flaw affects version V1.1.1.0 of GeoWebPlayer and can be exploited to achieve high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild and no vendor-provided patch or mitigation is currently documented.

Successful exploitation of this buffer overflow vulnerability can result in complete compromise of the affected system's confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code or cause denial of service. The CVSS 3.1 base score is 8.3, reflecting high severity with network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the localhost websocket server interface to trusted users only and monitor for suspicious activity. Avoid executing untrusted JSON commands on the websocket server. Follow vendor communications for updates on patches or official mitigations.