Heap-based Buffer Overflow Risk in Philips Hue Bridge HomeKit Setup

CVE-2026-3556

What is CVE-2026-3556?

There exists a vulnerability in the Philips Hue Bridge related to the HomeKit pair-setup, which can lead to a heap-based buffer overflow. This security flaw allows attackers on the same network to exploit the hk_hap_pair_storage_put function, where insufficient validation of user-supplied data length before copying leads to potential arbitrary code execution. Notably, this vulnerability does not require authentication, enabling attackers to target affected installations easily.

References