CVE-2026-118631 is a vulnerability in Philips Hue Bridge Pro affecting the factory data service that listens on TCP port 5001. It allows a local attacker with low-privileged code execution within a container to perform argument injection, leading to restricted file write capabilities. The flaw arises from improper validation of user-supplied strings before executing system calls, enabling modification of files under the service account context. The vulnerability has a low CVSS score of 3.8 and does not have known exploits in the wild.