Is CVE-2026-34120 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34120 being exploited in the wild.

How severe is CVE-2026-34120?

Medium severity, with a CVSS score of 6.5, published 2 April 2026.

Which products and versions are affected?

TP-Link Tapo C520ws Firmware before 1.2.4 Build 260326 Rel.24666n.

Is there a fix for CVE-2026-34120?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34120 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-34120?

Check whether you run TP-Link Tapo C520WS or TP-Link Tapo C520ws Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34120: TP-Link Tapo C520WS heap overflow in video stream parsing

CVE-2026-34120 · Severity: medium · CVSS 6.5 · Published 2026-04-02

A security vulnerability has been identified in the TP-Link Tapo C520WS, a popular outdoor security camera. An attacker on the same local network could send specially crafted data to the device to cause it to crash or become unresponsive. This results in a denial-of-service, effectively disabling the camera's ability to monitor or record video until it is recovered.

Technologies: TP-Link Tapo C520WS, TP-Link Tapo C520ws Firmware. Vendors: TP-Link.

Quick answers

Is CVE-2026-34120 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34120 being exploited in the wild.
How severe is CVE-2026-34120?: Medium severity, with a CVSS score of 6.5, published 2 April 2026.
Which products and versions are affected?: TP-Link Tapo C520ws Firmware before 1.2.4 Build 260326 Rel.24666n.
Is there a fix for CVE-2026-34120?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34120 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-34120?: Check whether you run TP-Link Tapo C520WS or TP-Link Tapo C520ws Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content. The vulnerability is caused by insufficient alignment and validation of buffer boundaries when processing streaming inputs. An attacker located on the same network segment (adjacent) can trigger heap memory corruption by sending crafted payloads that result in out-of-bounds write operations. Successful exploitation leads to a denial-of-service (DoS) where the device process crashes or becomes unresponsive. The issue is addressed in firmware version 1.2.4 Build 260326 Rel.24666n and later.

Affected products

TP-Link Tapo C520WS firmware before 1.2.4 Build 260326 Rel.24666n

Timeline

2026-04-02: disclosed
2026-04-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.