# Philips Hue Bridge over-the-air Zigbee heap buffer overflow leading to RCE (CVE-2026-3555)

> A heap-based buffer overflow in the Philips Hue Bridge v2 Zigbee custom ZCL command handler lets a network-adjacent attacker achieve arbitrary code execution on the bridge. Synacktiv demonstrated it at Pwn2Own Ireland 2025 and published a technical write-up in June 2026; Signify fixed it in Bridge v2 Software 1975170000.

- **Published:** 2026-10-30T23:27:12Z
- **Last reviewed:** 2026-10-30T23:27:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4865
- **ID:** TL-2026-4865
- **Severity:** HIGH (CVSS 8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3555

## Description

CVE-2026-3555 (ZDI-26-153) is a heap-based buffer overflow in the Zigbee stack of the Philips Hue Bridge v2 (MIPS-based embedded Linux device; main process `ipbridge`, built against musl libc 1.1.24 with a modified dlmalloc-style allocator). The vulnerable code handles a Philips manufacturer-specific ZCL command (opcode 0xC1, manufacturer code 0x100B) used to deliver fragmented 'Download Blob' / Model Info data during Zigbee device commissioning. A crafted sequence of frames declares a small total transfer size and then supplies a later fragment whose size exceeds the remaining declared space; the handler copies the oversized fragment into a fixed buffer without validating it against the remaining space, overflowing into the adjacent heap chunk and corrupting allocator metadata. The vulnerable path is only reachable while the bridge's internal 'Download Blob' state machine is in its data-request state, itself driven by the 'Configure Devices' commissioning state machine, so exploitation requires an attacker within Zigbee radio range during a pairing/commissioning window (ZDI vector: AV:A/AC:L/PR:N/UI:R).

Synacktiv researchers (Mehdi Talbi, Matthieu Breuil, Theo Gordyjan) demonstrated that the corrupted allocator metadata can be leveraged, through normal heap free/allocation behavior, into an attacker-controlled memory write primitive, which they escalated to full remote code execution by hijacking a function pointer used in Zigbee frame processing and ultimately spawning a reverse shell with root privileges on the bridge. The exploit was demonstrated live at Pwn2Own Ireland 2025 (Cork, Ireland, October 21-23, 2025) and required a custom hardware/software exploitation rig: an nRF52840 USB Zigbee dongle running the ZBOSS stack to craft and transmit malicious Zigbee frames, after the team's initial WHAD-based tooling proved too slow for the competition's timing constraints. The exploit succeeded on the team's second attempt (the first failed due to a Zigbee channel configuration mismatch). The vulnerability was reported to Signify on 2025-11-18, and the coordinated advisory with Synacktiv's public technical write-up released 2026-06-05 (ZDI advisory dated 2026-03-06). Signify fixed the issue in Hue Bridge v2 Software version 1975170000. No in-the-wild exploitation has been reported; this is public PoC/competition research. A companion SSTIC 2026 talk ('Flicker and Fall: Rooting the Philips Hue Bridge Both Remotely and Wirelessly') covers both this Zigbee bug and a separate HomeKit pairing-related bug chain found during the same Pwn2Own engagement, both yielding root on the bridge.

Impact: successful exploitation grants root-level code execution on the Hue Bridge, which acts as the trust center and control hub for the user's Zigbee smart-home network (lights, sensors, switches) and bridges that network to the user's LAN/cloud account, Apple HomeKit, and Matter. An attacker with bridge-level code execution can manipulate connected devices, pivot toward other LAN hosts, and establish persistence inside the smart-home environment. Exploitation is proximity-limited (Zigbee RF range) and requires a commissioning/pairing event, which limits mass remote exploitation but is realistic for a targeted, physically-proximate attacker (e.g., parked nearby, adjacent apartment, drive-by IoT attack).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505 Server Software Component
- T1219 Remote Access Tools
- T1495 Firmware Corruption

## Sources

- [Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge (Synacktiv, Mehdi Talbi and Matthieu Breuil)](https://www.synacktiv.com/en/publications/make-it-blink-over-the-air-exploitation-of-the-philips-hue-bridge.html)
- [ZDI-26-153: Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow RCE](https://www.zerodayinitiative.com/advisories/ZDI-26-153/)
- [NVD - CVE-2026-3555](https://nvd.nist.gov/vuln/detail/CVE-2026-3555)
- [Pwn2Own Ireland 2025: Day Three and Master of Pwn](https://www.thezdi.com/blog/2025/10/23/pwn2own-ireland-2025-day-three-and-master-of-pwn)
- [SSTIC 2026: Flicker and Fall - Rooting the Philips Hue Bridge Both Remotely and Wirelessly](https://www.sstic.org/2026/presentation/flicker_and_fall_rooting_the_philips_hue_bridge_both_remotely_and_wirelessly/)
- [ZDI-26-154: Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow RCE](https://zerodayinitiative.com/advisories/ZDI-26-154)
- [ZDI-26-159: Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow RCE](https://zerodayinitiative.com/advisories/ZDI-26-159)
- [Pwn2Own Ireland 2025 wraps with over $1 million awarded for 73 zero-days](https://cyberinsider.com/pwn2own-ireland-2025-wraps-with-over-1-million-awarded-for-73-zero-days/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4865