# CVE-2026-18167: TP-Link Archer AX55 stack-based buffer overflow in EasyMesh

Source: https://junglewise.ai/threats/cve-2026-18167-tp-link-archer-ax55-stack-based-buffer-overflow-in-easymesh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18167 · Severity: info · CVSS 7.7 · Published 2026-09-03

The TP-Link Archer AX55 router's EasyMesh module (used to extend and manage mesh Wi-Fi networks) contains a buffer overflow flaw that can be exploited by attackers on the local network. An attacker can send specially crafted data to crash the mesh service or potentially gain full control of the device when mesh mode is enabled, compromising its security, data handling, and availability.

Technologies: [TP-Link Archer AX55](https://junglewise.ai/threats/technologies/archer-ax55). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-18167 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18167 being exploited in the wild.

**How severe is CVE-2026-18167?** Informational severity, with a CVSS score of 7.7, published 3 September 2026.

**Which products and versions are affected?** TP-Link Archer AX55 v4 (prior to 1.2.1 Build 20260527).

**Is there a fix for CVE-2026-18167?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18167 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-18167?** Check whether you run TP-Link Archer AX55 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the EasyMesh daemon of TP-Link Archer AX55 v4 when Mesh mode is enabled. The vulnerability allows a local network (LAN) attacker to submit crafted input that triggers the overflow, causing the easymesh daemon to crash. An attacker with network access to the device can exploit this to achieve remote code execution with the privileges of the daemon process. The vulnerability requires no authentication and the affected versions are Archer AX55 V4 prior to firmware 1.2.1 Build 20260527, which contains the fix. The attack vector is adjacent network access.

## Affected products

- TP-Link Archer AX55 v4 (prior to 1.2.1 Build 20260527)

## Timeline

- 2026-09-03: disclosed

## References

- [https://www.tp-link.com/us/support/download/archer-ax55/v4/](https://www.tp-link.com/us/support/download/archer-ax55/v4/)
- [https://www.tp-link.com/us/support/faq/5279/](https://www.tp-link.com/us/support/faq/5279/)

## Related threats

- [TP-Link Archer AX55 hard-coded RSA key in web login](https://junglewise.ai/threats/cve-2026-18330-tp-link-archer-ax55-hard-coded-rsa-key-in-web-login)
- [TP-Link Archer AX53 and AX55 stack overflow in tdpServer](https://junglewise.ai/threats/cve-2025-15608-tp-link-archer-ax53-and-ax55-stack-overflow-in-tdpserver)