# CVE-2026-34118: Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in multiple TP-Link Tapo Cameras Status: published. Published: 2026-04-02. Updated: 2026-11-02. A heap-based buffer overflow vulnerability was identified in multiple TP-Link Tapo cameras in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input.   An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries.  Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive. ## Remediation - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/us/support/download/tapo-c100/v5/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/en/support/download/tapo-c100/v5/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/us/support/download/tapo-c101/v5/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/us/support/download/tapo-c210/v3.60/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/en/support/download/tc70/v3/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: TPLink) — https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes ## Affected products and versions - TP-Link Systems Inc. / Tapo C520WS v2.6: ≥ 0; < 1.2.4 Build 260326 Rel.24666n (affected, custom). Source: CNA: TPLink - TP Link Systems Inc. / Tapo C100 v5: ≥ 0; < 1.5.4 Build 260528 Rel.11462n (affected, custom). Source: CNA: TPLink - TP Link Systems Inc. / Tapo C101 v5: ≥ 0; < 1.5.4 Build 260528 Rel.11462n (affected, custom). Source: CNA: TPLink - TP Link Systems Inc. / Tapo C210 v3: ≥ 0; < V3.6_1.2.7 Build 260818 (affected, custom). Source: CNA: TPLink - TP Link Systems Inc. / Tapo TC70 v3: ≥ 0; < 1.9.2 Build 261009 Rel.61408n (affected, custom). Source: CNA: TPLink - TP Link Systems Inc. / Tapo C200 v3: ≥ 0; < 1.9.2 Build 261009 Rel.61408n (affected, custom). Source: CNA: TPLink ## Severity and prioritization - CVSS 4.0: 7.1 (high); CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N; source: CNA: TPLink - CISA KEV: No listing in collected sources - EPSS: 0.39% as of 2026-11-02; percentile 33.01% - SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP - Weaknesses: CWE-122 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/us/support/faq/5047/ (CNA: TPLink; vendor-advisory) - https://www.tp-link.com/us/support/download/tapo-c100/v5/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/en/support/download/tapo-c100/v5/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/us/support/download/tapo-c101/v5/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/us/support/download/tapo-c210/v3.60/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/en/support/download/tc70/v3/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes (CNA: TPLink; patch) - https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes (CNA: TPLink; patch) ## Provenance - CNA: TPLink: https://www.cve.org/CVERecord?id=CVE-2026-34118; retrieved 2026-11-02; source updated 2026-11-02 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-34118; retrieved 2026-11-02; source updated Not reported Revision: 7d15026e93da286429e8a7ba4f37e20ba99801909f5ab59462f5b4857cd0570f Canonical: https://y2.dev/cve/CVE-2026-34118 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.