ZDI-CAN-28434: ZDI-26-963: (Pwn2Own) Philips Hue Bridge hap_pair_setup_handler Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-126978.

Affected Software

1 affected component

Philips Hue Bridge

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Who is exposed to exploitation?

Philips Hue Bridge installations reachable by a network-adjacent attacker are exposed. The available information does not identify affected firmware versions or configuration-specific limitations.

Does an attacker need credentials or prior access?

No. Authentication is not required, so an attacker with network-adjacent access can attempt exploitation without Philips Hue Bridge credentials.

What is the potential impact of successful exploitation?

Successful exploitation can allow arbitrary code execution on the affected Philips Hue Bridge. ZDI assigned the issue a CVSS rating of 8.8.

ZDI-CAN-28434: ZDI-26-963: (Pwn2Own) Philips Hue Bridge hap_pair_setup_handler Heap-based Buffer Overflow Remote Code Execution Vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to exploitation?

Does an attacker need credentials or prior access?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

Does an attacker need credentials or prior access?

What is the potential impact of successful exploitation?