This vulnerability (CVE-2026-3555) affects Philips Hue Bridge version 1.73.1973146020. It is a heap-based buffer overflow (CWE-122) in the handling of custom Zigbee ZCL frames during the Model Info download process. The root cause is a lack of proper size validation before copying data into a fixed-size heap buffer, which can be exploited by a network-adjacent attacker to execute arbitrary code on the device. Exploitation requires user interaction to initiate device pairing. The CVSS v3.0 base score is 8.0, indicating high severity with attack vector being adjacent network, low attack complexity, no privileges required, but user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution on the Philips Hue Bridge device in the context of the device itself. This can lead to full compromise of the device, potentially affecting the security and operation of the smart home environment controlled by the Hue Bridge. The vulnerability requires user interaction (device pairing initiation) and network adjacency, limiting the attack surface somewhat. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid initiating the device pairing process in untrusted network environments and restrict network access to the Hue Bridge. Monitor Philips' official channels for updates and apply patches promptly once available.