EUVD-2026-18428Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
4DescriptionCVE.org
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies without continuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries. Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.
AnalysisAI
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows unauthenticated network attackers to trigger denial-of-service by sending crafted HTTP payloads that bypass boundary validation during segmented request body parsing. The vulnerability exploits insufficient write-boundary verification in the HTTP parsing loop, causing heap memory corruption that crashes or hangs the device process. Patch is available from the vendor.
Technical ContextAI
The vulnerability resides in the HTTP request parsing component of the Tapo C520WS camera firmware (v2.6), specifically in the handler responsible for assembling multi-part or segmented HTTP request bodies. The root cause is CWE-122 (Heap-based Buffer Overflow), which occurs when the parser fails to continuously validate write boundaries as it appends external input to a heap-allocated buffer. Attackers can supply crafted payloads with improperly formatted or oversized segment data that causes the append operation to write beyond the allocated buffer's boundaries. The absence of persistent boundary checks between successive segment writes creates a classic heap overflow condition where attacker-controlled data overwrites adjacent heap structures, leading to memory corruption and process instability.
RemediationAI
Vendor-released patch is available per TP-Link advisory. Users should immediately check the Tapo C520WS firmware release notes and support pages (https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes) to identify and download the patched firmware version that addresses CVE-2026-34119. Perform a firmware update via the Tapo app or device web interface to move to a version beyond v2.6 that includes the heap overflow fix. As a temporary mitigation for devices that cannot be patched immediately, restrict network access to the camera using firewall rules or network segmentation to limit exposure to attackers on the same network segment; however, this is not a substitute for patching and should only be used as a short-term measure while patches are being staged.
More in Tapo C520Ws V2 6
View allTP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauth
Denial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer o
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows local network attackers to cause denial of service by send
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers on the same network segment to trigger de
Stack-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers to trigger denial-of-service by sending
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today