CVE-2026-76650: CWE-476 NULL pointer dereference in TP-Link System Inc. TL-WR841N v14

This vulnerability involves a NULL pointer dereference in the UPnP service of the TL-WR841N v14 device from TP-Link System Inc. It is triggered by specially crafted SOAP state variable query requests, which cause the process hosting the UPnP service to crash or become unstable. The impact is a denial-of-service condition that disrupts UPnP discovery and related management functionality until recovery actions such as process restart or device reboot are performed. There are no known exploits in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation results in denial-of-service affecting the UPnP service on the device, causing instability or termination of the UPnP process. This disrupts UPnP discovery and state query functions until the affected process is restarted or the device is rebooted. No further impact such as privilege escalation or data compromise is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, affected devices should be monitored for UPnP service disruptions and restarted or rebooted if instability occurs. Network exposure of the UPnP service should be minimized where possible.