Heap-Based Buffer Overflow Vulnerability in TP-Link Tapo C520WS

CVE-2026-34118

What is CVE-2026-34118?

A heap-based buffer overflow vulnerability was discovered in the TP-Link Tapo C520WS v2.6, stemming from inadequate validation of buffer capacity during HTTP POST body parsing. This oversight allows an attacker on the same network segment to exploit the vulnerability by sending specially crafted payloads, resulting in heap memory corruption. The successful execution of this exploit can trigger a Denial-of-Service condition, leading the affected device's process to crash or become unresponsive.

References