CVE-2026-18167

CVE-2026-18167 is a stack-based buffer overflow (CWE-121) in the EasyMesh module of the TP-Link Archer AX55 v4 router. When Mesh mode is enabled, an attacker positioned on the LAN (adjacent network, no credentials or user interaction required) can send crafted input to the easymesh daemon that overflows a stack buffer. Successful exploitation crashes the EasyMesh daemon and may potentially allow remote code execution on the device, with high impact to the confidentiality, integrity, and availability of the affected router. Only Archer AX55 v4 units with Mesh mode enabled are affected; units running in standard (non-mesh) mode are not exposed to this flaw. As of this writing there is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns a low 0.3% probability of exploitation in the next 30 days.

What to do: Check whether your Archer AX55 v4 is running in Mesh/EasyMesh mode; if mesh operation is not required, disable it until a fix is available. Monitor TP-Link's security advisories and update to the fixed firmware once TP-Link publishes a patch (no fixed version is provided in the current data). Restrict LAN access to trusted devices in the meantime, since exploitation requires an adjacent network attacker.