EUVD-2026-18430
GHSA-m7f4-p6pg-38mf
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
4DescriptionCVE.org
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insufficient alignment and validation of buffer boundaries when processing streaming inputs.An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries. Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.
AnalysisAI
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows local network attackers to cause denial of service by sending crafted payloads during asynchronous video stream processing, triggering memory corruption and process crashes. The vulnerability stems from insufficient buffer boundary validation in streaming input handling. A vendor patch is available.
Technical ContextAI
The vulnerability exists in the video stream parsing logic of the TP-Link Tapo C520WS IP camera firmware version 2.6. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), which occurs when the application writes data beyond the allocated boundaries of a heap buffer. Specifically, the asynchronous processing of local video stream content lacks proper alignment checks and boundary validation before writing to heap memory. This is a memory safety issue common in C/C++ network device firmware where input validation on streaming protocols is insufficient. The affected product is a network-connected IP camera that processes video streams, making it susceptible to attack from any device on the same network segment that can send crafted network payloads to trigger the overflow condition.
RemediationAI
TP-Link has released a vendor patch for this vulnerability. Users of Tapo C520WS v2.6 should immediately download and install the latest firmware version from the official TP-Link support pages (https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes). The specific patched firmware version number is not provided in the available advisory data, but TP-Link's release notes will indicate which version addresses CVE-2026-34120. Users should also refer to the TP-Link FAQ (https://www.tp-link.com/us/support/faq/5047/) for detailed installation and troubleshooting guidance. As a temporary mitigation while patching is pending, restrict network access to the camera to trusted devices only, such as by implementing network segmentation or firewall rules to limit which devices can communicate with the camera.
More in Tapo C520Ws V2 6
View allTP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauth
Denial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer o
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows unauthenticated network attackers to trigger denial-of-ser
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers on the same network segment to trigger de
Stack-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers to trigger denial-of-service by sending
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today