CVE-2025-56364

Analyzed Analyzed - Analysis Complete

Use of Uninitialized Value in Matter SDK Leads to DoS

Publication date: 2026-07-14

Last updated on: 2026-07-17

Assigner: MITRE

Description

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID. The issue affects all versions before commit 0360cc3 (Dec 5, 2024) and leads to denial of service through SIGABRT. It is fixed by adding a .HasValue() check before access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-17

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2025-56364

EUVD

EUVD-2025-210471

Affected Vendors & Products

Vendor	Product	Version / Range
csa-iot	matter	to 1.4.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

Executive Summary

This is a use of uninitialized value vulnerability in the Matter SDK before version 1.4.0. It occurs when the GetDestinationGroupId().Value() method is called without checking if a value exists first. This causes a crash when an InvokeCommand is sent without initializing the destination group ID, leading to a denial of service through SIGABRT.

Detection Guidance

This vulnerability can be detected by checking the version of the Matter SDK (connectedhomeip) on your system. If the version is before 1.4.0 or before commit 0360cc3 (Dec 5, 2024), it is vulnerable. Use commands like 'git log --oneline' or 'git rev-parse HEAD' to check the commit hash in the SDK directory.

Impact Analysis

This vulnerability can cause system crashes (denial of service) when processing certain commands. If exploited, it may disrupt the availability of services relying on the Matter SDK, potentially affecting smart home devices or IoT systems using this technology.

Compliance Impact

This vulnerability may impact compliance with regulations requiring availability of systems, such as GDPR (data processing continuity) or HIPAA (service reliability). A denial of service could violate availability requirements, potentially leading to non-compliance if not addressed promptly.

Mitigation Strategies

Immediately update the Matter SDK to version 1.4.0 or later. If updating is not possible, apply the patch by adding a .HasValue() check before calling GetDestinationGroupId().Value() in the InvokeCommand method to prevent crashes.

Hi! I’m here to help you understand CVE-2025-56364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70