Threat Intelligence Database

CVE-2026-57274 is a high-severity buffer overflow vulnerability in GeoVision Inc.'s GeoWebPlayer version 1.1.1.0. The vulnerability exists in the websocket server component that handles commands from localhost, specifically in the 'connectionInfo' command handler. This handler copies attacker-controlled JSON strings into fixed-size buffers without enforcing length limits, leading to classic buffer overflow conditions. The flaw affects the password field when no key is present, potentially allowing an attacker to execute arbitrary code or cause denial of service.

CVE-2026-57267 is a high-severity vulnerability in GeoVision Inc.'s GeoWebPlayer version 1.1.1.0. The vulnerability involves improper validation of array indices in the Websocket server component, which accepts commands from localhost. Specifically, the 'index' parameter used in various commands is not properly checked for valid range, allowing out-of-bounds array access. This can lead to critical impacts including confidentiality, integrity, and availability compromise. No official patch or remediation guidance is currently available from the vendor.