CVE-2025-56364

Name of the Vulnerable Software and Affected Versions Matter SDK (connectedhomeip) versions prior to 1.4.0

Description A use of uninitialized value occurs when the GetDestinationGroupId().Value() method is called without verifying if a value exists. This happens when an InvokeCommand is sent without initializing the destination group ID, resulting in a crash via SIGABRT (a signal sent to a process to abort execution) and causing a denial of service.

Recommendations Update Matter SDK (connectedhomeip) to version 1.4.0 or later. As a temporary mitigation, ensure that the destination group ID is initialized before calling the GetDestinationGroupId().Value() method.