CVE-2026-76651: Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N
A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that corrupts memory by overwriting data beyond the bounds of an internal buffer.
Successful exploitation may result in modification or corruption of process memory, potentially leading to undefined application behavior. Arbitrary code execution, information disclosure, and denial-of-service conditions have not been demonstrated.
Affected Software
Event History
Frequently Asked Questions
Who can attempt to exploit this issue?
A remote attacker does not need to authenticate, but must be able to send crafted multipart/form-data requests to the device's embedded HTTP service.
Which devices are identified as affected?
The affected product identified in the available information is the TP-Link TL-WR841N v14.
What impact has been demonstrated?
Successful exploitation may corrupt or modify process memory and cause undefined application behavior. Arbitrary code execution, information disclosure, and denial of service have not been demonstrated.