CVE-2026-42369: GV-VMS V20 Stack Buffer Overflow in WebCam Server via Base64 Decoding (CWE-787)

Overview

GV-VMS V20 is Geovision video monitoring software that aggregates feeds from surveillance cameras and manages other security devices. According to the record, the software can be reached remotely through the WebCam Server feature, which exposes a web interface. The record describes a stack-based buffer overflow in the handling of base64-decoded data by the gvapi endpoint.

Impact

• The CNA vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges required, no user interaction, a changed scope, and high impact on confidentiality, integrity and availability.
• The record states that exploitation could lead to code execution as SYSTEM on the machine running the service.
• The record notes that the web server binary is compiled without ASLR, which the description says makes exploitation easier.

Affected products and versions

• The product named in the record is GV-VMS V20 from Geovision.
• The record contains no affected version list and no fixed version. The exact versions affected are unknown from the available data.
• Organizations should confirm with the vendor whether their build and the WebCam Server feature are affected.

Exploitation status

• The CISA KEV catalog does not list this CVE in the data provided.
• The EPSS probability in the record is 0.00867 with a percentile of 0.57647. This is a statistical estimate of exploitation likelihood, not evidence of exploitation.
• No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Check the vendor security page for a fixed release or advisory: Geovision cyber security page. The record does not confirm a patch.
• If the WebCam Server remote access feature is not required, disable it until the vendor guidance is verified.
• Restrict network access to the web interface and the gvapi endpoint to trusted management networks, and place it behind a VPN or firewall where feasible.
• Limit the privileges of the service account where the product's configuration allows it, and review the host's exposure to the internet.

Detection guidance

• Review network logs for unexpected requests to the gvapi endpoint, especially from unknown or external sources.
• Monitor for repeated authentication failures on the Authorization header mechanism and for unusual traffic volumes to the web interface.
• Watch for unexpected crashes or restarts of the GV-VMS service, and for new processes or changes started under SYSTEM on the host.

Limitations of the available information

• The record provides no affected version range, no fixed version, and no vendor patch details.
• The description refers to specific code behavior, but no independent technical confirmation from the vendor appears in the record.
• The EPSS date in the record is later than the publication date, so the EPSS values should be treated with caution.
• Whether the flaw is exploitable in a particular deployment depends on configuration, which is unknown here.

Frequently asked questions

What is CVE-2026-42369?

It is a stack-based buffer overflow (CWE-787) in Geovision GV-VMS V20, reported in the WebCam Server gvapi handling of base64-decoded data. The CNA rates it Critical with CVSS 3.1 10.0.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list it in the data provided, and no confirmed exploitation appears in the sources consulted.

Which versions are affected and is there a fix?

The record does not list affected versions or a fixed version. Check the vendor security page for current guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.