ZDI-CAN-28326: ZDI-26-154: (Pwn2Own) Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hkhappairstorageput function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HomeKit service.
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3556.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28326?
ZDI-CAN-28326 is classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix ZDI-CAN-28326?
To remediate ZDI-CAN-28326, ensure your Philips Hue Bridge is updated to the latest firmware version provided by Philips.
Who is affected by ZDI-CAN-28326?
ZDI-CAN-28326 affects all installations of the Philips Hue Bridge that have not been patched.
What type of vulnerability is ZDI-CAN-28326?
ZDI-CAN-28326 is a heap-based buffer overflow vulnerability that allows for remote code execution.
Can ZDI-CAN-28326 be exploited without authentication?
Yes, ZDI-CAN-28326 can be exploited by network-adjacent attackers without requiring any authentication.