CVE-2025-56363

Analyzed Analyzed - Analysis Complete

Null Pointer Dereference in Matter SDK

Publication date: 2026-07-14

Last updated on: 2026-07-17

Assigner: MITRE

Description

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-17

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2025-56363

EUVD

EUVD-2025-210470

Affected Vendors & Products

Vendor	Product	Version / Range
csa-iot	matter	to 1.4.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a null pointer dereference vulnerability in the Matter SDK (connectedhomeip) before version 1.4.0. The ReadRevisionAttribute function in multiple clusters lacks validation of the delegate pointer before accessing it. A remote unauthenticated attacker can send a crafted read request to crash the device, causing a denial of service.

Detection Guidance

This vulnerability can be detected by checking the version of the Matter SDK in use. If the version is before 1.4.0, the system is vulnerable. Commands to check the version may include inspecting package managers or build files for connectedhomeip or matter_sdk.

Impact Analysis

This vulnerability allows a remote attacker to crash affected devices by sending specially crafted requests. This could disrupt services relying on the Matter SDK, such as smart home devices, leading to temporary unavailability or loss of functionality.

Mitigation Strategies

Update the Matter SDK to version 1.4.0 or later to address the null pointer dereference vulnerability in the ReadRevisionAttribute function. Ensure all affected clusters are patched to prevent remote unauthenticated denial of service attacks.

Hi! I’m here to help you understand CVE-2025-56363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70