This vulnerability (CVE-2026-57879) affects GeoVision GV-LPC2011 and GV-LPC2211 devices at version 1.12 and earlier. It is a stack-based buffer overflow (CWE-121) in the ssvr service due to improper bounds checking of RTSP custom authentication data. Because the flaw is exploitable without authentication, a remote attacker can send specially crafted RTSP requests to trigger memory corruption, leading to denial of service or potentially arbitrary code execution. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits in the wild are reported.

Successful exploitation can result in memory corruption that may cause denial of service or allow arbitrary code execution on affected devices. This compromises the confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication, increasing the risk of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices, especially blocking unauthorized RTSP traffic from untrusted sources. Monitor for unusual activity related to RTSP requests. Follow GeoVision Inc.'s advisories for updates on patches or mitigations.