CVE-2026-34119
Heap-Based Buffer Overflow in TP-Link Tapo C520WS Causes DoS
Publication date: 2026-04-02
Last updated on: 2026-04-06
Assigner: TPLink
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tp-link | tapo_c520ws_firmware | to 1.2.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-34119 is a heap-based buffer overflow vulnerability found in the TP-Link Tapo C520WS v2.6 device. It occurs in the HTTP parsing loop when the device appends segmented HTTP request bodies without properly verifying continuous write boundaries. This insufficient boundary validation allows an attacker on the same network segment to send specially crafted payloads that cause heap memory corruption by writing beyond the allocated buffer limits.
Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a Denial-of-Service (DoS) condition on the affected TP-Link Tapo C520WS device. An attacker on the same network segment can exploit the flaw to crash the device’s process or make it unresponsive, potentially disrupting the device’s normal operation and any services relying on it.
What immediate steps should I take to mitigate this vulnerability?
Users are strongly advised to update the TP-Link Tapo C520WS device to the latest firmware version 1.2.4 Build 260326 Rel.24666n or later.
Updating the firmware mitigates this heap-based buffer overflow vulnerability and related issues, preventing potential Denial-of-Service (DoS) conditions caused by crafted HTTP requests.