> CVE-2026-34120: TP-Link HTTP POST body heap buffer overflow

An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a heap buffer overflow, which leads to remote code execution. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in April 2026 contains this vulnerability as CVE-2026-34120. Vulnerability Details In the HTTP Server implementation of TAPO devices, another overflow similar to CVE-2026-34118 is present in http_read_content_asyn. This gets called repeatedly, e.g. if new data arrived on a read that timed out.