Heap-based Buffer Overflow in TP-Link Tapo C520WS

CVE-2026-34119

What is CVE-2026-34119?

A heap-based buffer overflow vulnerability in TP-Link Tapo C520WS v2.6 has been identified during the HTTP parsing loop. This issue arises when appending segmented request bodies without proper validation of write boundaries, allowing for insufficient boundary checks on external HTTP input. An attacker on the same network can exploit this vulnerability by sending specially crafted payloads that lead to memory corruption, potentially resulting in a Denial-of-Service (DoS) condition. This exploitation method can cause the device to crash or become unresponsive.

References