Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability allows a network-adjacent attacker to execute arbitrary code as the HomeKit service. The flaw resides in hk_hap_pair_storage_put where user-supplied data is copied into a fixed-length heap buffer without length validation, leading to a buffer overflow. This weakness (CWE-122) can compromise confidentiality, integrity, and availability of the device and connected homes.

The vulnerability affects Philips Hue Bridge devices. Specific firmware or software version information is not provided in the available data.

The CVSS score of 8.8 indicates high severity. The EPSS score is under 1%, suggesting a low current exploitation probability, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires no authentication and is accessible over the network, making it potentially exploitable by attackers in proximity to the bridge. The exploit path involves crafting malicious HomeKit pairing data that triggers the buffer overflow and enables arbitrary code execution.