This vulnerability (CVE-2026-34124) affects TP-Link Tapo C520WS version 2.6 and involves a buffer overflow due to insufficient size checking during HTTP request path parsing. Although the raw request path length is restricted, the normalization process expands the path without proper bounds checking, leading to memory corruption. The flaw can be exploited remotely by an attacker on the adjacent network to cause denial of service through device reboot or system interruption. The CVSS 4.0 score is 7.1, indicating high severity, with attack vector local network (adjacent network), low attack complexity, and no privileges or user interaction required.

Exploitation of this vulnerability results in denial of service by causing buffer overflow and memory corruption, which can interrupt system operation or reboot the device. This disrupts the availability of the affected TP-Link Tapo C520WS device. There is no indication of code execution or data confidentiality/integrity impact in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a patch is available, network segmentation to restrict access to the device from untrusted adjacent networks may reduce exposure.