Critical RCE in Philips Hue Bridge (CVE‑2026‑3556) Enables Remote Code Execution via HomeKit Pair‑Setup

Critical RCE in Philips Hue Bridge (CVE‑2026‑3556) Enables Remote Code Execution via HomeKit Pair‑Setup

What It Is — A heap‑based buffer overflow exists in the hk_hap_pair_storage_put function of the Philips Hue Bridge HomeKit pairing service. The flaw allows an unauthenticated, network‑adjacent attacker to overwrite a fixed‑size heap buffer and execute arbitrary code with the privileges of the HomeKit service.

Exploitability — The vulnerability is actively exploitable; no authentication or user interaction is required. A proof‑of‑concept was demonstrated during the Pwn2Own competition. CVSS 3.1 base score 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Products — Philips Hue Bridge (all firmware versions prior to Bridge v2 1975170000).

TPRM Impact —

• Corporate IoT deployments that rely on Hue lighting can become an entry point for lateral movement across the corporate network.
• Compromise of a Hue Bridge may expose internal network topology and enable credential harvesting from connected devices.

Recommended Actions —

1. Verify that all Hue Bridges are running firmware v2 1975170000 or later; apply the update immediately.
2. Segment IoT devices on a dedicated VLAN with strict firewall rules limiting inbound traffic to management ports.
3. Conduct an inventory of third‑party IoT assets and assess exposure to external networks.
4. Include Hue Bridge firmware version checks in your continuous vendor risk monitoring program.

Source: Zero Day Initiative Advisory ZDI‑26‑154