Stack Buffer Overflow in GeoVision IP Camera Discovery

CVE-2026-88287 is a stack buffer overflow vulnerability (CWE-121) in GeoVision GV-LPC2211 V1.13 that exploits unauthenticated ONVIF WS-Discovery Probe requests. The vulnerability stems from insufficient bounds checking on Scopes tokens, allowing remote attackers to craft malicious discovery requests that corrupt stack memory and crash the device's discovery process. This affects organizations deploying GeoVision IP cameras in security surveillance infrastructure, where discovery mechanisms are often exposed on network segments or accessible to unauthenticated clients. The lack of authentication requirement significantly lowers the barrier to exploitation, making this a network-reachable denial-of-service vector that can disrupt camera availability and monitoring capabilities.

While this CVE does not map to specific MITRE ATT&CK techniques, Casky.ai's 754 security skills would detect the attack patterns through behavioral analysis of malformed ONVIF requests and stack manipulation attempts. Although zero Casky skills currently match this exact vulnerability, practitioners using Casky would identify related defensive capabilities around protocol fuzzing detection, memory corruption indicators, and network discovery anomalies. A practitioner's findings would highlight unauthenticated WS-Discovery traffic patterns, abnormal Scope token structures, and device crash events—enabling network defenders to implement discovery request filtering, rate limiting on ONVIF endpoints, and segmentation of camera infrastructure from untrusted network zones before exploitation occurs.