CVE-2025-56365

Analyzed Analyzed - Analysis Complete

Matter SDK Assertion Failure in Command Processing

Publication date: 2026-07-14

Last updated on: 2026-07-17

Assigner: MITRE

Description

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-17

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2025-56365

EUVD

EUVD-2025-210472

Affected Vendors & Products

Vendor	Product	Version / Range
csa-iot	matter	to 1.4.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This is a reachable assertion vulnerability in the Matter SDK before version 1.4.0. It occurs when an InvokeCommandRequest is sent to a non-existent endpoint and cluster. The code incorrectly treats the endpoint as valid due to missing checks, leading to a VerifyOrDie failure and causing the system to crash with a SIGABRT signal.

Detection Guidance

This vulnerability can be detected by monitoring for crashes or SIGABRT signals in Matter SDK applications when invalid InvokeCommandRequest messages are processed. Check logs for VerifyOrDie failures in ProcessCommandDataIB or crashes related to endpoint/cluster handling.

Impact Analysis

This vulnerability can cause a denial of service by crashing the Matter SDK application when processing malformed commands. It may disrupt smart home devices using the affected SDK version, leading to unexpected behavior or system unavailability.

Compliance Impact

This vulnerability causes a crash (SIGABRT) due to a reachable assertion in the Matter SDK's command processing logic. While it does not directly impact data confidentiality or integrity, system unavailability from crashes could affect compliance with standards requiring high availability, such as HIPAA for healthcare systems or GDPR for continuous data processing.

Mitigation Strategies

Update the Matter SDK to version 1.4.0 or later to address the reachable assertion vulnerability in the interaction model command processing logic.

Hi! I’m here to help you understand CVE-2025-56365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70