This vulnerability (CVE-2026-57880) affects GeoVision GV-LPC2011 and GV-LPC2211 devices at version 1.12 and earlier. It is a stack-based buffer overflow in the ssvr component triggered by improper bounds checking of RTSP Digest authentication fields. Because the vulnerability is unauthenticated and remotely exploitable over the network, an attacker can send a specially crafted RTSP request with excessively long authentication data to cause memory corruption. The impact includes denial of service and potential arbitrary code execution. The CVSS v3.1 base score is 9.8, reflecting its critical severity. No official patch or remediation level is currently provided, and no known exploits in the wild have been reported.

Successful exploitation can lead to memory corruption resulting in denial of service or arbitrary code execution on affected devices. The vulnerability is remotely exploitable without authentication, increasing its risk profile. The critical CVSS score (9.8) indicates high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices' RTSP service to trusted sources only and monitor for unusual RTSP traffic patterns. Avoid exposing these devices directly to untrusted networks.