The vulnerability is a heap-based buffer overflow in the Philips Hue Bridge Zigbee stack during the handling of custom Zigbee ZCL frames in the Model Info download functionality. Because the firmware does not validate the size of the data before copying it to a fixed‑size heap buffer, a network‑adjacent attacker can trigger the overflow and execute arbitrary code in the context of the device. This remote code execution can potentially allow the attacker to compromise the bridge’s firmware and any home automation functions it controls.

The affected systems are Philips Hue Bridge devices. No specific firmware or model versions are provided in the data, so all current and unpatched installations of Philips Hue Bridge are potentially vulnerable.

The CVSS score is 8, indicating high severity, and the EPSS score is less than 1%, indicating a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local‑network attacker and user interaction to initiate the device pairing process, so the attack vector is network‑adjacent with user interaction.