CVE-2026-57268

{
  "id": "CVE-2026-57268",
  "sourceIdentifier": "0df08a0e-a200-4957-9bb0-084f562506f9",
  "published": "2026-07-02T04:17:12.467",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoWebPlayer (also called \"Web Plugin\" in the GV-VMS documentation and \"WS Player\" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.\n\nThe Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.\n\n\n### saveVideo command index-out-of-bound\n\nWhen sending the `saveVideo` command, the `index` field is extracted from the websocket message [1]. Then without checking the range of the index, it is used to trigger a CriticalSection ([2]) and releases it [3]. The release function call ([3]) is executed using a function pointer which will be read out of bounds potentially leading to code execution:\n\n\n\n\n\n     v6 = get_entry(a2, \"index\");\n\n      result = json_is_value_int(v6);\n\n      if ( (_BYTE)result )\n\n      {\n\n        v8 = get_entry(a2, \"index\");\n\n        index = json_value_to_int(&v8->value);  // [1]\n\n        result = CCriticalSection::EnterCritSection(&this->crit_sections[index]);  //[2]\n\n        if ( result )\n\n        {\n\n          if ( this->array_of_IPCams[index] )\n\n          {\n\n            if ( this->array_of_IPCams[index]->field_20 )\n\n              do_PostMessageA((CViewer *)this->array_of_IPCams[index], 0x111u, 0x139Fu, v11);\n\n          }\n\n          return (*(int (__thiscall **)(CCriticalSection *))(this->crit_sections[index].vtbl + 20))(&this->crit_sections[index]); //[3]\n\n        }\n\n      }"
    },
    {
      "lang": "es",
      "value": "GeoWebPlayer (también llamado ’Web Plugin’ en la documentación de GV-VMS y ’WS Player’ para VMS-Cloud) es un complemento que se puede instalar con varios software de GeoVision (GV-VMS, GV-Cloud, ...). Crea un servidor websocket que expande las capacidades de las diversas interfaces web proporcionadas por el software de GeoVision y puede ser necesario para que funcionen correctamente.\n\nEl servidor Websocket puede aceptar varios comandos provenientes de localhost. Muchos de los comandos tomarán un valor “index” que luego se utiliza para acceder a varios arrays para entrar en secciones críticas, realizar varias acciones a través de llamadas a funciones, etc. Sin embargo, el valor “index” generalmente no se verifica para un rango válido, y como tal, puede usarse para acceder a múltiples arrays fuera de los límites.\n\n### Comando saveVideo con índice fuera de los límites\n\nAl enviar el comando “saveVideo”, el campo “index” se extrae del mensaje websocket [1]. Luego, sin verificar el rango del índice, se utiliza para activar una CriticalSection ([2]) y la libera [3]. La llamada a la función de liberación ([3]) se ejecuta utilizando un puntero de función que se leerá fuera de los límites, lo que podría conducir a la ejecución de código:\n\n””“\n     v6 = get_entry(a2, “index”);\n\n      result = json_is_value_int(v6);\n\n      if ( (_BYTE)result )\n\n      {\n\n        v8 = get_entry(a2, “index”);\n\n        index = json_value_to_int(&v8  ->  value);  // [1]\n\n        result = CCriticalSection::EnterCritSection(&this  ->  crit_sections[index]);  //[2]\n\n        if ( result )\n\n        {\n\n          if ( this  ->  array_of_IPCams[index] )\n\n          {\n\n            if ( this  ->  array_of_IPCams[index]  ->  field_20 )\n\n              do_PostMessageA((CViewer *)this  ->  array_of_IPCams[index], 0x111u, 0x139Fu, v11);\n\n          }\n\n          return (*(int (__thiscall **)(CCriticalSection *))(this  ->  crit_sections[index].vtbl + 20))(&this  ->  crit_sections[index]); //[3]\n\n        }\n\n      }\n”””"
    }
  ],
  "affected": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "affectedData": [
        {
          "vendor": "GeoVision Inc.",
          "product": "GeoWebPlayer",
          "defaultStatus": "unaffected",
          "packageName": "GeoWebPlayer",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "versions": [
            {
              "version": "V1.1.1.0",
              "status": "affected"
            },
            {
              "version": "V1.1.3.0",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-02T12:35:11.850544Z",
          "id": "CVE-2026-57268",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    },
    {
      "url": "https://www.geovision.com.tw/cyber_security.php",
      "source": "0df08a0e-a200-4957-9bb0-084f562506f9"
    }
  ]
}