This vulnerability (CVE-2026-57878) affects GeoVision Inc.'s GV-LPC2011 and GV-LPC2211 devices at version 1.12 and earlier. It is a stack-based buffer overflow (CWE-121) in the thttpd web server component due to improper bounds checking of HTTP request parameters. The flaw allows an unauthenticated remote attacker to send a specially crafted HTTP request with excessively long input, leading to memory corruption. The impact includes denial of service and the possibility of arbitrary code execution. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation can lead to memory corruption resulting in denial of service or arbitrary code execution on affected devices. The vulnerability is exploitable remotely without authentication, posing a critical risk to device security and potentially allowing full system compromise.

No official patch or remediation has been published by GeoVision Inc. for this vulnerability as of the current information. Users should monitor the vendor's advisories for updates and apply any official fixes once available. Until a patch is released, consider limiting network exposure of affected devices and employing network-level protections such as firewalls to restrict access to the vulnerable service.