CVE-2026-88289: GV-LPC2011/LPC2211 - Multiple Pre-Authentication Stack Buffer Overflows in VLSVR Request Handlers

Published Sep 10, 2026

Updated

GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.

Affected Software

1 affected component

GeoVision GV-LPC2211=V1.14 (260903)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GeoVision GV-LPC2211 to a version that resolves this vulnerability.
Fixed in V1.14 (260903)

Event History

Sep 10, 2026

CVE Published

via MITRE·08:25 AM

Data Sourced

via MITRE·08:25 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit the affected VLSVR request handlers. No credentials or user interaction are required.

What is the expected impact of exploitation?

The documented impact is a crash of the VLSVR service, resulting in a denial of service. The provided information does not establish confidentiality or integrity impact.

How can I determine whether a device is affected?

The affected product and version identified in the available data are GeoVision GV-LPC2211 V1.14 (260903). Systems exposing the VLSVR service should be treated as potentially reachable by remote attackers.