Heap‑Overflow RCE in Philips Hue Bridge (CVE‑2026‑3555) Threatens Smart‑Lighting Deployments

Heap‑Overflow RCE in Philips Hue Bridge (CVE‑2026‑3555) Threatens Smart‑Lighting Deployments

What It Is – A heap‑based buffer overflow in the custom Zigbee command handler of the Philips Hue Bridge allows an attacker to execute arbitrary code on the device. The flaw is triggered when a user initiates the Zigbee pairing process, after which malicious ZCL frames can corrupt a fixed‑size heap buffer.

Exploitability – The vulnerability was demonstrated in the Pwn2Own competition, confirming a working exploit. CVSS 8.0 (High) – AV: Adjacent, AC: Low, PR: None, UI: Required, S: Unchanged, C/H/I/A: High.

Affected Products – Philips Hue Bridge (all firmware versions prior to 1975170000).

TPRM Impact – Smart‑building and IoT deployments that rely on Hue lighting become a potential entry point for lateral movement, data exfiltration, or ransomware. Third‑party risk assessments must treat the Bridge as a critical supply‑chain component because compromised devices can be used to pivot into corporate networks.

Recommended Actions –

1. Deploy the firmware fix (v2 1975170000 or later) immediately.
2. Conduct an inventory of all Hue Bridges across the organization and verify patch status.
3. Segregate IoT devices onto a dedicated VLAN with strict firewall rules.
4. Disable or tightly control the Zigbee pairing function when not needed.
5. Monitor network traffic for anomalous Zigbee‑related communications and unexpected outbound connections from the Bridge.

Source: Zero Day Initiative Advisory – ZDI‑26‑153