The vulnerability CVE-2026-0918 involves a NULL pointer dereference (CWE-476) in the HTTP service of TP-Link Tapo C100 v5, C220 v1, and C520WS v2 cameras. When the service receives a POST request with an excessively large Content-Length header, it attempts a memory allocation that fails, resulting in a NULL pointer dereference and crashing the main service process. This crash causes the device to restart automatically. An unauthenticated attacker can exploit this by sending repeated malicious POST requests, causing repeated crashes and effectively denying service to legitimate users.

Successful exploitation results in a temporary denial of service due to repeated crashes and automatic restarts of the affected camera devices. The attacker does not require authentication to trigger this condition. There is no indication of data compromise or code execution, only service disruption. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, mitigate by restricting network access to the affected devices' HTTP service from untrusted sources to prevent unauthenticated attackers from sending malicious POST requests.