Threat reportVulnerabilityTL-2026-4865
Philips Hue Bridge over-the-air Zigbee heap buffer overflow leading to RCE (CVE-2026-3555)
Philips Hue Bridge over-the-air Zigbee heap buffer overflow (TL-2026-4865), also tracked as Make it Blink, is a high-severity software vulnerability scored CVSS 8, first published 2026-10-30. It has no confirmed attribution, affects Signify (Philips Hue) Philips Hue Bridge v2 (firmware), references 1 CVE (CVE-2026-3555), maps to 6 MITRE ATT&CK techniques (T1059.004, T1190, T1203), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4865
- Threat ID
- TL-2026-4865
- Also known as
- Make it Blink, ZDI-26-153
- Severity
- HIGH
- CVSS
- 8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumer, residential, smart-home, critical-infrastructure-adjacent
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Philips Hue Bridge over-the-air Zigbee heap buffer overflow
Malware and tooling: WHAD, ZBOSS (Nordic Zigbee stack)
How Philips Hue Bridge over-the-air Zigbee heap buffer overflow works
A heap-based buffer overflow in the Philips Hue Bridge v2 Zigbee custom ZCL command handler lets a network-adjacent attacker achieve arbitrary code execution on the bridge. Synacktiv demonstrated it at Pwn2Own Ireland 2025 and published a technical write-up in June 2026; Signify fixed it in Bridge v2 Software 1975170000.
CVE-2026-3555 (ZDI-26-153) is a heap-based buffer overflow in the Zigbee stack of the Philips Hue Bridge v2 (MIPS-based embedded Linux device; main process `ipbridge`, built against musl libc 1.1.24 with a modified dlmalloc-style allocator). The vulnerable code handles a Philips manufacturer-specific ZCL command (opcode 0xC1, manufacturer code 0x100B) used to deliver fragmented 'Download Blob' / Model Info data during Zigbee device commissioning. A crafted sequence of frames declares a small total transfer size and then supplies a later fragment whose size exceeds the remaining declared space; the handler copies the oversized fragment into a fixed buffer without validating it against the remaining space, overflowing into the adjacent heap chunk and corrupting allocator metadata. The vulnerable path is only reachable while the bridge's internal 'Download Blob' state machine is in its data-request state, itself driven by the 'Configure Devices' commissioning state machine, so exploitation requires an attacker within Zigbee radio range during a pairing/commissioning window (ZDI vector: AV:A/AC:L/PR:N/UI:R).
Synacktiv researchers (Mehdi Talbi, Matthieu Breuil, Theo Gordyjan) demonstrated that the corrupted allocator metadata can be leveraged, through normal heap free/allocation behavior, into an attacker-controlled memory write primitive, which they escalated to full remote code execution by hijacking a function pointer used in Zigbee frame processing and ultimately spawning a reverse shell with root privileges on the bridge. The exploit was demonstrated live at Pwn2Own Ireland 2025 (Cork, Ireland, October 21-23, 2025) and required a custom hardware/software exploitation rig: an nRF52840 USB Zigbee dongle running the ZBOSS stack to craft and transmit malicious Zigbee frames, after the team's initial WHAD-based tooling proved too slow for the competition's timing constraints. The exploit succeeded on the team's second attempt (the first failed due to a Zigbee channel configuration mismatch). The vulnerability was reported to Signify on 2025-11-18, and the coordinated advisory with Synacktiv's public technical write-up released 2026-06-05 (ZDI advisory dated 2026-03-06). Signify fixed the issue in Hue Bridge v2 Software version 1975170000. No in-the-wild exploitation has been reported; this is public PoC/competition research. A companion SSTIC 2026 talk ('Flicker and Fall: Rooting the Philips Hue Bridge Both Remotely and Wirelessly') covers both this Zigbee bug and a separate HomeKit pairing-related bug chain found during the same Pwn2Own engagement, both yielding root on the bridge.
Impact: successful exploitation grants root-level code execution on the Hue Bridge, which acts as the trust center and control hub for the user's Zigbee smart-home network (lights, sensors, switches) and bridges that network to the user's LAN/cloud account, Apple HomeKit, and Matter. An attacker with bridge-level code execution can manipulate connected devices, pivot toward other LAN hosts, and establish persistence inside the smart-home environment. Exploitation is proximity-limited (Zigbee RF range) and requires a commissioning/pairing event, which limits mass remote exploitation but is realistic for a targeted, physically-proximate attacker (e.g., parked nearby, adjacent apartment, drive-by IoT attack).
MITRE ATT&CK techniques used in TL-2026-4865
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Command and Control
Impact
Persistence
Affected products and versions in Philips Hue Bridge over-the-air Zigbee heap buffer overflow
- Signify (Philips Hue) — Philips Hue Bridge v2 (firmware)
Vulnerable versions: 01028090; 01029624; 01030262; versions prior to 1975170000
Fixed in: 1975170000 and later
Remediation for Philips Hue Bridge over-the-air Zigbee heap buffer overflow
Patches
- Philips Hue Bridge v2 Software 1975170000 (fixes CVE-2026-3555)
Immediate actions
- Update Philips Hue Bridge v2 to Bridge v2 Software version 1975170000 or later
- Restrict Zigbee commissioning/pairing windows to trusted times and locations
- Avoid leaving the bridge in pairing/commissioning mode unattended
- Physically limit Zigbee RF exposure where feasible (device placement away from building perimeter)
Workarounds
- No official workaround beyond updating; limiting physical/RF proximity and avoiding unattended commissioning reduces exposure
Longer-term hardening
- Maintain an inventory of smart-home hub firmware versions and enforce automatic update policies
- Segment IoT/smart-home networks (VLAN) from sensitive LAN segments to limit lateral movement from a compromised bridge
- Monitor vendor security advisories for Hue Bridge and other Zigbee coordinator devices
- Apply defense-in-depth for consumer IoT hubs acting as protocol trust centers (Zigbee/Matter/HomeKit bridges)
CVEs associated with Philips Hue Bridge over-the-air Zigbee heap buffer overflow
Weaknesses (CWE) in Philips Hue Bridge over-the-air Zigbee heap buffer overflow
Timeline of Philips Hue Bridge over-the-air Zigbee heap buffer overflow
- Pwn2Own Ireland 2025 begins in Cork, Ireland; smart home category including Philips Hue Bridge featured for the first time.
- Synacktiv researchers (Mehdi Talbi, Matthieu Breuil, Theo Gordyjan) demonstrate over-the-air Zigbee RCE against the Philips Hue Bridge at Pwn2Own Ireland 2025, succeeding on their second attempt.
- Vulnerability reported to Signify (Philips Hue) via Zero Day Initiative coordinated disclosure process.
- Zero Day Initiative publishes advisory ZDI-26-153 for CVE-2026-3555 alongside related Hue Bridge advisories (ZDI-26-154, ZDI-26-159) from the same Pwn2Own engagement.
- CVE-2026-3555 entry published to the National Vulnerability Database with CVSS 3.1 score 8.0.
- SSTIC 2026 talk 'Flicker and Fall: Rooting the Philips Hue Bridge Both Remotely and Wirelessly' presents the Zigbee and HomeKit bug chains found during the Pwn2Own research.
- Synacktiv publishes detailed technical write-up 'Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge' covering the full exploit chain.
Sources cited for Philips Hue Bridge over-the-air Zigbee heap buffer overflow
- Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge (Synacktiv, Mehdi Talbi and Matthieu Breuil)
- ZDI-26-153: Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow RCE
- NVD - CVE-2026-3555
- Pwn2Own Ireland 2025: Day Three and Master of Pwn
- SSTIC 2026: Flicker and Fall - Rooting the Philips Hue Bridge Both Remotely and Wirelessly
- ZDI-26-154: Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow RCE
- ZDI-26-159: Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow RCE
- Pwn2Own Ireland 2025 wraps with over $1 million awarded for 73 zero-days
Detection coverage for TL-2026-4865
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4865 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.