This vulnerability in Philips Hue Bridge's HomeKit implementation, specifically the hk_hap_pair_storage_put function, permits a heap-based buffer overflow that leads to remote code execution. The flaw arises because the function, which listens on TCP port 8080 by default, fails to validate the length of user-supplied data before copying it into a heap buffer. Attackers with network proximity can send malformed data to exploit the overflow and execute arbitrary code within the device's context. The weakness is identified as CWE-122.

Affects Philips Hue Bridge installations utilizing the HomeKit hk_hap_pair_storage_put endpoint. No specific vendor-released version numbers were disclosed in the advisory; therefore any firmware that implements this function is potentially vulnerable. Users should consult the Philips Hue Bridge firmware changelog or support page for confirmation.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the vulnerable service listens on port 8080 and requires no authentication, any device on the same local network can create an attack vector. If successfully triggered, the heap overflow would give the attacker full control over the device.