CVE-2026-16519 is a DLL hijacking vulnerability in GeoVision's IP Device Utility, a desktop application used to configure IP cameras in enterprise surveillance deployments. The vulnerability stems from unsafe DLL search paths—the application loads DLLs from locations an attacker can control, allowing arbitrary code execution under the context of the running user.
The CVSS score of 7.3 (High) combined with an EPSS score of only 0.00118 creates apparent tension. The EPSS number is not wrong—automated exploitation of this specific utility is unlikely. But the local-attacker requirement is misleading in the target environment. This utility runs on sysadmin workstations that manage physical security infrastructure. In enterprise surveillance environments, insiders, contractors, and anyone with badge access to the building have legitimate local presence on these machines. The attacker population is small but motivated, and they don't need automated exploits—they need one unpatched session on a provisioning workstation to push malicious configuration to the camera network.
Check this: if your organization uses GeoVision IP cameras, identify which workstations run the IP Device Utility. These machines are high-value targets precisely because they sit at the IT/OT bridge—domain-joined, running with elevated privileges, and on the same network segment as the physical security cameras. A DLL hijack on one of these workstations doesn't require lateral movement; it's already at the detonation point for the entire OT blast radius.
Prioritize patching based on workstation exposure, not just CVSS severity. In air-gapped or low-patch-velocity OT environments, the remediation window for this utility stretches longer than most software—surveillance operators may not update provisioning tools for months or years. Treat any unpatched instance on a camera-management workstation as an active escalation path from physical security perimeters into the IT domain. Verify the installation directory for unexpected DLLs, and consider application whitelisting rules that restrict which directories the utility can load libraries from. If you cannot patch immediately, restrict user permissions on workstations running this tool and monitor for DLL creation in its working directory.