CVE-2026-3560

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the hk_hap_pair_storage_put function of the HomeKit implementation, which listens on TCP port 8080 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28469.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-356005.4Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax CVE-2026-356014.1Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries v CVE-2026-356027.1Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlle CVE-2026-356037.3Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from CVE-2026-356048.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356057.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356067.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356078.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356086.1QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The ap CVE-2026-35618.0Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-CVE-2026-356108.8PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(us CVE-2026-356117.5Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0,