CVE-2026-7372 is a critical (CVSS 9.0) stack overflow in the WebCam Server login of GeoVision GV-VMS V20, version 20.0.2. An unauthenticated HTTP request can lead to code execution. The record names no fix, so check GeoVision's security page and limit network access.
What's affected
The record lists GeoVision GV-VMS and its firmware, version V20 20.0.2. The vulnerable feature is the WebCam Server login. The description comes from Talos Intelligence's report.
No fixed version is stated in the record. GeoVision's cyber security page is the place to look for one, and I could not find a matching entry there as plain text. Treat the software as unpatched until you confirm otherwise.
How to check if you're exposed
Check the installed GV-VMS version in the application. If it is V20 20.0.2, you are in scope.
Then check whether the WebCam Server service is enabled and where it listens. If it is exposed to the internet, close that first.
What to do now
- Find every GV-VMS installation and its version.
- Check GeoVision's cyber security page for an update or advisory and apply it when it exists.
- Disable the WebCam Server feature if you do not need it.
- Keep the video management host off the internet, and reachable only from trusted networks.
- Monitor the host for unexpected crashes or restarts of the service.
Why it matters
The record maps this to CWE-787, out-of-bounds write. The description says a call to sscanf splits the authorization data into username and password variables without limiting how many characters it copies. The stack variables hold 40 characters, so a longer username or password overflows them.
That is a classic bounded copy mistake. A size limit in the format string, or a length check before parsing, prevents it. Because the request does not need a login to reach this code, the pre-authentication position raises the severity.
Video systems often sit on flat networks with little monitoring. The KEV flag is false and the record does not describe exploitation.
Quick check
Is a fix available for CVE-2026-7372?
I could not confirm one. Check GeoVision's security page and restrict network access in the meantime.
Sources
Last reviewed: 19 October 2026.
