A heap-based buffer overflow occurs in the HTTP parsing loop when HTTP request bodies are appended without proper boundary verification. The flaw allows an attacker on the same network to overflow allocated memory, causing the device to crash or become unresponsive. The impact is a loss of availability for the affected device.

TP‑Link Tapo C520WS firmware version 2.6.

The vulnerability has a CVSS score of 7.1, indicating a high severity level. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local network attacker who can send crafted HTTP requests to the device. While the exploit requires proximity to the device’s network segment, the lack of enforcement of buffer limits makes exploitation straightforward for an attacker who can reach the device. Given the lack of EPSS data, the exact probability of exploitation is uncertain, but the high CVSS score and local network exposure suggest a significant risk if the device is reachable by untrusted hosts.