CVE-2026-75619

MediumCVSS 5.7/10Last modified Oct 26, 2026

Description

Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes.

Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

VendorProductVersions
TP-Link Systems Inc.Tapo C100 v5< 1.5.4 Build 260528 Rel.11462n
TP-Link Systems Inc.Tapo C101 v5< 1.5.4 Build 260528 Rel.11462n

References

Timeline

Published
Aug 19, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-75624.3The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due tCVE-2026-756216.2IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions CVE-2026-756248.8IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass CVE-2026-756259.0Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressabCVE-2026-756269.3SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers caCVE-2026-756279.8Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authenticCVE-2026-756285.7Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslaCVE-2026-756295.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipuCVE-2026-75634.3The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in CVE-2026-756317.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-756327.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. CVE-2026-756335.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An
CVE-2026-75619: Medium severity, CVSS 5.7 | Vulnix