{"id":"CVE-2026-57881","title":"GV-LPC2011/LPC2211 - unauthorized stack-based buffer overflow vulnerability (vlsvr)","published":"2026-06-26T08:16:25.087Z","updated":"2026-10-25T22:10:00.150Z","severity":"critical","cvssScore":9.8,"epss":0.00649,"epssPct":0.51606,"kev":false,"maturity":"none","actionScore":39,"primaryVendor":"geovision inc.","primaryProduct":"gv-lpclpc2011/2211","cweId":"CWE-121","fixAvailable":false,"tags":["pre-auth","rce","memory","remote","no-ui"],"epssDelta7":0.0027,"summary":"An unauthenticated\nstack-based buffer overflow vulnerability exists in vlsvr in GeoVision\nGV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by\ninsufficient length validation when processing remote login data. A remote\nattacker may exploit this vulnerability by sending crafted login data with\noverly long input, resulting in memory corruption, denial of service, or potentially\narbitrary code execution.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","cvssSource":"nvd-secondary","cweName":"Stack-based Buffer Overflow","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"GV","ssvc":{"exploitation":"none","automatable":"yes","impact":"partial"},"sources":{"tr":"2026-10-01T11:24:25.940Z","adp":"2026-06-26T16:08:37.099Z","cna":"2026-06-26T16:08:37.099Z","nvd":"2026-10-25T22:10:00Z","epss":"2026-11-12","cna_seen":"2026-09-29T11:23:32.583Z"},"cvssCna":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"hasPatchRef":false,"credits":[{"name":"Jincheng Wang (@winmt), Professor Le Yu","kind":"finder","org":"Nanjing University"}],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}