A heap-based buffer overflow exists in the asynchronous parsing of local video stream content in TP-Link Tapo C520WS firmware 2.6. Insufficient alignment and validation allow overwriting of heap memory, leading to a process crash or loss of responsiveness. The weakness is a classic memory corruption flaw (CWE‑122).

The vulnerability affects TP‑Link Systems Inc.’s Tapo C520WS device running firmware version 2.6. Only that build is listed as vulnerable; newer firmware releases may contain the fix.

The score of 7.1 indicates moderate‑to‑high severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The flaw is not catalogued in the CISA KEV list. Attackers would need to be on the same local network segment to send crafted video stream packets that trigger the overflow, resulting in a denial of service. The impact is limited to the device itself, causing it to hang or crash, but the local network traffic may be disrupted until the device is rebooted or patched.