CVE-2026-3555

Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process. The specific flaw exists within the handling of custom Zigbee ZCL frames in the Model Info download functionality. The issue results from the lack of proper validation of the size of data prior to copying it to a fixed-size heap buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28276.

• CWE-122

• https://www.zerodayinitiative.com/advisories/ZDI-26-153/Third Party Advisory

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35544An issue was discovered in Roundcube Webmail before 1.5.14 a…5.3
• CVE-2026-35545An issue was discovered in Roundcube Webmail before 1.5.15 a…8.2
• CVE-2026-35546Anviz CX2 Lite and CX7 are vulnerable to unauthenticated fir…9.8
• CVE-2026-35547When processing the header of an incoming message, libnv fai…8.1
• CVE-2026-35548An issue was discovered in guardsix (formerly Logpoint) ODBC…8.5
• CVE-2026-35549An issue was discovered in MariaDB Server before 11.4.10, 11…6.5
• CVE-2026-35552In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UD…8.1
• CVE-2026-35553Bluetooth ACPI Drivers provided by Dynabook Inc. contain a s…8.4
• CVE-2026-35554A race condition in the Apache Kafka Java producer client’s …8.7
• CVE-2026-35555PowerSYSTEM Center feature for device project groups allows …7
• CVE-2026-35556OpenPLC_V3 is vulnerable to a Plaintext Storage of a Passwor…7.5
• CVE-2026-35558Improper neutralization of special elements in the authentic…7.8