Loading vulnerability…
Unauthenticated stack overflow RCE in GeoVision GV-VMS V20 WebCam Server gvapi
CVE-2026-42369 is a stack-based buffer overflow in the WebCam Server component of GeoVision GV-VMS V20. When remote access is enabled, the product exposes a web interface and a gvapi endpoint that implements its own HTTP Authorization-based authentication handling. In the vulnerable code path, a Base64-decoded credential string is copied character-by-character into a fixed-size stack buffer without proper bounds checking. If the decoded input exceeds the size of that stack buffer, memory corruption occurs on the stack. The WebCam Server binary is noted as being compiled without ASLR, which materially lowers exploitation complexity. Because the attacker controls the Authorization header contents and can trigger the vulnerable parsing logic remotely, the flaw can be exploited for unauthenticated remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in full remote code execution in the security context of the affected service, which is described as SYSTEM on the host running GV-VMS V20. This gives an attacker complete compromise of the affected server, including the ability to execute arbitrary code, install malware, tamper with video monitoring operations, access or manipulate surveillance data, pivot to adjacent systems, and disrupt availability of the monitoring platform.
If you can’t patch tonight, do this now.
Until patching is completed, disable the WebCam Server remote-access feature if it is not strictly required. If remote access must remain enabled, restrict access to the web interface and gvapi endpoint to trusted management networks or VPN-only access, block direct internet exposure, and place the service behind network-layer access controls. Additional hardening should include host-based exploit mitigations where available, close monitoring for malformed or oversized Authorization headers, and segmentation of the GV-VMS host from broader enterprise networks to reduce post-compromise impact.
Patch, then assume compromise.
Apply the vendor patch or fixed release for GeoVision GV-VMS V20 that corrects the unsafe handling of Authorization header data in the WebCam Server gvapi authentication path. If a patched version is available, upgrade affected deployments promptly and verify that the vulnerable WebCam Server component is no longer exposed in its prior form. Because the issue is a memory-safety flaw in native code, remediation requires vendor-provided code changes rather than configuration-only hardening.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.