CVE-2026-12760 is a high-severity vulnerability affecting the TP-Link Tapo C200 v3 camera. It arises from improper handling of IPv4 fragmented packets in the network packet processing logic, leading to allocation of resources without limits or throttling (CWE-770). An unauthenticated attacker on the adjacent network can send specially crafted fragmented packets to exhaust device resources, causing a temporary denial-of-service condition. This disrupts the camera's normal operation, resulting in loss of video monitoring and recording capabilities. No patch or official remediation has been disclosed yet, and no known exploits are reported in the wild.

The vulnerability allows an unauthenticated adjacent attacker to cause excessive resource consumption on the affected device, leading to instability and temporary denial-of-service. This results in the camera becoming unresponsive and intermittent loss of video monitoring and recording, impacting the availability of the security device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device from untrusted adjacent networks to reduce exposure to crafted IPv4 fragmented packets.