Is CVE-2026-8618 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8618 being exploited in the wild.

How severe is CVE-2026-8618?

Informational severity, published 1 October 2026.

Is there a fix for CVE-2026-8618?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8618 attacked?

It is attacked from the adjacent network or over the network, in a network appliance.

Am I affected by CVE-2026-8618?

Check whether you run TP-Link Deco M9 Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8618: TP-Link Deco M9 Plus stack buffer overflow in TDDPv2

CVE-2026-8618 · Severity: info · Published 2026-10-01

The TP-Link Deco M9 Plus mesh Wi-Fi system contains a stack buffer overflow vulnerability in its TDDPv2 service that could allow an attacker on the same network to crash the device or execute arbitrary code during setup. An attacker without authentication can exploit this by sending specially crafted network packets, potentially disrupting home network connectivity or gaining control of the device.

Vendors: TP-Link.

Quick answers

Is CVE-2026-8618 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8618 being exploited in the wild.
How severe is CVE-2026-8618?: Informational severity, published 1 October 2026.
Which products and versions are affected?: TP-Link Deco M9 Plus V2.
Is there a fix for CVE-2026-8618?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8618 attacked?: It is attacked from the adjacent network or over the network, in a network appliance.
Am I affected by CVE-2026-8618?: Check whether you run TP-Link Deco M9 Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the /usr/bin/tddp service (TDDPv2 protocol handler, subtype 0x91) due to insufficient validation of decrypted request data length before copying into a fixed-size stack buffer. The vulnerability is accessible to adjacent unauthenticated attackers via crafted TDDP packets, particularly during the device setup phase, and permits denial of service or arbitrary code execution.

Affected products

TP-Link Deco M9 Plus V2

Timeline

2026-10-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.