CVE-2026-92838

GeoVision's GV-Remote E-Map desktop application loads one or more dynamic-link libraries from an unsafe search path (CWE-427), so Windows resolves a DLL name to a directory an attacker controls before the legitimate library location. A local attacker with low privileges who can write a malicious DLL into such a directory gets it loaded by the application, with the CVSS vector indicating no user interaction is required beyond the application's normal startup/loading behavior. Successful exploitation yields arbitrary code execution in the security context of the GV-Remote E-Map process, giving the attacker the privileges of the user running the surveillance client. Only organizations running GeoVision's GV-Remote E-Map client on Windows workstations are affected; the flaw is local (AV:L) and cannot be exploited remotely by itself. There is no evidence of exploitation in the wild, the flaw is not in CISA KEV, and no public proof-of-concept is known.

What to do: Check GeoVision's support/download portal for an updated GV-Remote E-Map release and upgrade as soon as a fixed version is published, since no fixed version is identified in the current data. Until then, restrict write permissions on the application's installation folder and any directories on its DLL search path to administrators, run the client as a standard (non-elevated) user, and avoid installing it on shared or multi-tenant workstations. Inventory Windows hosts running GV-Remote E-Map and monitor for a vendor advisory or KEV listing.