CVE-2026-3556

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3556", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-03-04T19:42:32.733Z", "datePublished": "2026-03-13T20:36:44.408Z", "dateUpdated": "2026-03-16T20:17:16.686Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-03-13T20:36:44.408Z"}, "title": "Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the hk_hap_pair_storage_put function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HomeKit service. Was ZDI-CAN-28326."}], "affected": [{"vendor": "Philips", "product": "Hue Bridge", "versions": [{"version": "1.73.1973146020", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-154/", "name": "ZDI-26-154", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-04T19:42:32.769Z", "datePublic": "2026-03-06T21:19:09.676Z", "source": {"lang": "en", "value": "InnoEdge Labs"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T20:16:52.038932Z", "id": "CVE-2026-3556", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:17:16.686Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T20:16:52.038932Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:17:11.127Z"}}], "cna": {"title": "Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "InnoEdge Labs"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Philips", "product": "Hue Bridge", "versions": [{"status": "affected", "version": "1.73.1973146020"}], "defaultStatus": "unknown"}], "datePublic": "2026-03-06T21:19:09.676Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-154/", "name": "ZDI-26-154", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-04T19:42:32.769Z", "descriptions": [{"lang": "en", "value": "Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the hk_hap_pair_storage_put function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HomeKit service. Was ZDI-CAN-28326."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-03-13T20:36:44.408Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3556", "state": "PUBLISHED", "dateUpdated": "2026-03-16T20:17:16.686Z", "dateReserved": "2026-03-04T19:42:32.733Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-03-13T20:36:44.408Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Hue Bridge", "vendor": "Philips", "versions": [{"status": "affected", "version": "1.73.1973146020"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:philips:hue_bridge_v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4C925A5-D9FB-482D-A98D-F879B1BD21EC", "versionEndExcluding": "1975170000", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:philips:hue_bridge_v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "55B37D18-3A59-423E-9D73-F80DFDB14C4D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the hk_hap_pair_storage_put function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HomeKit service. Was ZDI-CAN-28326."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por desbordamiento de b\u00fafer basado en mont\u00edculo en el Pair-Setup de HomeKit de Philips Hue Bridge. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar c\u00f3digo arbitrario en instalaciones afectadas de Philips Hue Bridge. La autenticaci\u00f3n no es necesaria para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro de la funci\u00f3n hk_hap_pair_storage_put. El problema se debe a la falta de validaci\u00f3n adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos a un b\u00fafer de longitud fija basado en mont\u00edculo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del servicio HomeKit. Fue ZDI-CAN-28326."}], "id": "CVE-2026-3556", "lastModified": "2026-06-17T10:43:46.907", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3556", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T20:16:52.038932Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:48.663", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-154/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.73.1973146020"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Hue Bridge", "source": "cna", "vendor": "Philips"}, "product": "hue_bridge", "vendor": "phillips"}], "analysis": {"en": {"generated_at": "2026-03-16T23:07:45.848974+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware or vendor patch for Philips Hue Bridge as soon as it is released. ", "If a patch is not yet available, isolate the Hue Bridge from untrusted or external networks and disable HomeKit pairing functionality to prevent exposure. ", "Continuously monitor Philips\u2019 official channels for update releases and apply them promptly once available."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Philips Hue Bridge devices. Specific firmware or software version information is not provided in the available data.", "description_and_impact": "Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability allows a network-adjacent attacker to execute arbitrary code as the HomeKit service. The flaw resides in hk_hap_pair_storage_put where user-supplied data is copied into a fixed-length heap buffer without length validation, leading to a buffer overflow. This weakness (CWE-122) can compromise confidentiality, integrity, and availability of the device and connected homes.", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity. The EPSS score is under 1%, suggesting a low current exploitation probability, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires no authentication and is accessible over the network, making it potentially exploitable by attackers in proximity to the bridge. The exploit path involves crafting malicious HomeKit pairing data that triggers the buffer overflow and enables arbitrary code execution."}}}}, "created": "2026-03-16T09:23:50.697178+00:00", "updated": "2026-03-23T13:39:54.896475+00:00", "vendors": ["phillips", "phillips$PRODUCT$hue_bridge"]}