This vulnerability in the Philips Hue Bridge arises from a lack of proper length validation when copying user-supplied data into a fixed-length heap buffer within the hk_hap_pair_storage_put function. This heap-based buffer overflow (CWE-122) can be triggered by a network-adjacent attacker without authentication, potentially leading to remote code execution in the context of the HomeKit service. The affected firmware version is 1.73.1973146020. The CVSS 3.0 vector indicates low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated, network-adjacent attacker to execute arbitrary code on the Philips Hue Bridge device, compromising the HomeKit service context. This can lead to full control over the device, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the Philips Hue Bridge to trusted networks only and monitor for unusual activity. Avoid exposing the device to untrusted networks.