CVE-2026-88287 is a stack-based buffer overflow vulnerability (CWE-121) in GeoVision GV-LPC2211 version 1.13. The flaw arises because the device does not bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests. This allows a remote attacker to corrupt the stack control state, resulting in a denial of service by crashing the discovery process. The vulnerability requires no privileges and no user interaction, and it is exploitable remotely over the network. There is no known exploit in the wild and no vendor advisory confirming a patch or mitigation.

An attacker can remotely send crafted ONVIF WS-Discovery Probe requests with excessive Scopes tokens to cause a stack-based buffer overflow, leading to stack corruption and crashing the discovery process on the affected device. This results in a denial of service condition. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting network access to the affected device's discovery service to trusted sources to reduce exposure.