CVE-2025-56363

Name of the Vulnerable Software and Affected Versions Matter SDK (connectedhomeip) versions prior to 1.4.0

Description A null pointer dereference occurs in the ReadRevisionAttribute() function, which is utilized across several clusters including Channel, Account Login, and TargetNavigator. The issue stems from a lack of proper validation of the delegate pointer before it is dereferenced. A remote unauthenticated attacker can trigger a device crash, resulting in a denial of service, by sending a specially crafted read request.

Recommendations Update Matter SDK (connectedhomeip) to version 1.4.0 or later. As a temporary mitigation, restrict access to the ReadRevisionAttribute() function to minimize the risk of exploitation.