{"id":"CVE-2026-34119","aliases":["EUVD-2026-18428","GHSA-25v3-gpg9-m4p7"],"status":"published","title":"Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS","description":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00239,"percentile":0.15135,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-122"],"published":"2026-04-02T17:19:50Z","modified":"2026-07-24T21:10:00Z","products":[{"vendor":"tp-link","product":"tapo_c520ws_firmware"},{"vendor":"tp-link systems inc.","product":"tapo c520ws v2.6"}],"references":[{"url":"https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","tags":["patch","Release Notes"]},{"url":"https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","tags":["patch","Release Notes"]},{"url":"https://www.tp-link.com/us/support/faq/5047/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34119"},{"url":"https://www.tp-link.com/us/support/faq/5047"},{"url":"https://github.com/advisories/GHSA-25v3-gpg9-m4p7"}],"sources":{"cve":[{"id":"CVE-2026-34119","title":"Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS","description":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive.","status":"published","published":"2026-04-02T17:19:50.931Z","modified":"2026-04-03T13:06:40.136Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-18428","description":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive.","status":"published","published":"2026-04-02T17:19:50Z","modified":"2026-04-03T13:06:40Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:16.92155Z"}],"ghsa":[{"id":"GHSA-25v3-gpg9-m4p7","title":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the...","description":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive.","status":"published","published":"2026-04-02T18:31:38Z","modified":"2026-04-06T21:32:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:07:11.075264Z"}],"nvd":[{"id":"CVE-2026-34119","description":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive.","status":"published","published":"2026-04-02T18:16:28.68Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:12.73929Z"}]}}