CVE-2026-57268

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.<br /> <br /> The Websocket server can accept various commands coming from localhost. Many of the commands will take an `index` value that is then used to access various arrays to enter critical sections, perform various actions via function calls, etc. However the `index` value is usually not checked for valid range, and as such it can be used to access multiple arrays out-of-bound.<br /> <br /> <br /> ### saveVideo command index-out-of-bound<br /> <br /> When sending the `saveVideo` command, the `index` field is extracted from the websocket message [1]. Then without checking the range of the index, it is used to trigger a CriticalSection ([2]) and releases it [3]. The release function call ([3]) is executed using a function pointer which will be read out of bounds potentially leading to code execution:<br /> <br /> <br /> <br /> <br /> <br /> v6 = get_entry(a2, "index");<br /> <br /> result = json_is_value_int(v6);<br /> <br /> if ( (_BYTE)result )<br /> <br /> {<br /> <br /> v8 = get_entry(a2, "index");<br /> <br /> index = json_value_to_int(&amp;v8-&gt;value); // [1]<br /> <br /> result = CCriticalSection::EnterCritSection(&amp;this-&gt;crit_sections[index]); //[2]<br /> <br /> if ( result )<br /> <br /> {<br /> <br /> if ( this-&gt;array_of_IPCams[index] )<br /> <br /> {<br /> <br /> if ( this-&gt;array_of_IPCams[index]-&gt;field_20 )<br /> <br /> do_PostMessageA((CViewer *)this-&gt;array_of_IPCams[index], 0x111u, 0x139Fu, v11);<br /> <br /> }<br /> <br /> return (*(int (__thiscall **)(CCriticalSection *))(this-&gt;crit_sections[index].vtbl + 20))(&amp;this-&gt;crit_sections[index]); //[3]<br /> <br /> }<br /> <br /> }