Out-of-Bounds Stack Write Vulnerability in TP-Link Tapo C500 Camera

CVE-2026-104945

What is CVE-2026-104945?

The TP-Link Tapo C500 camera v2.0 is susceptible to an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can exploit this flaw by sending an excessive number of preset-related elements, which may lead to writes beyond the bounds of the fixed-size stack arrays. This could result in the affected service crashing, triggering a denial-of-service condition that hampers camera management and PTZ functionality. Continuous exploitation attempts might disrupt operations until the service resets or recovers.

References