A heap‑based buffer overflow occurs during asynchronous parsing of local video stream content, allowing an attacker on the same network to send crafted inputs that exceed buffer boundaries. Successful exploitation corrupts heap memory and crashes or freezes the device, leading to a denial of service.

The vulnerability affects TP‑Link Systems Inc.’s Tapo C520WS v2.6, a consumer‑grade security camera used in residential or small business environments. No other versions are listed as affected.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, so the exact likelihood of exploitation cannot be quantified. The attack requires local network access, but can be executed from any machine within the same segment, so a compromised or malicious device could trigger the DoS. The vulnerability is not currently catalogued in CISA’s KEV list, suggesting no widespread exploitation has been documented. Mitigation should be pursued immediately because the denial of service could disrupt surveillance functions.