CVE-2025-56365

Name of the Vulnerable Software and Affected Versions Matter SDK (connectedhomeip) versions prior to 1.4.0

Description A reachable assertion issue exists in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster, the CodegenDataModelProvider::Invoke function fails to perform necessary checks, incorrectly treating the endpoint as valid. This leads to a VerifyOrDie failure within the ProcessCommandDataIB function, resulting in a system crash (SIGABRT). A SIGABRT is a signal sent to a process to cause it to abort execution.

Recommendations Update Matter SDK (connectedhomeip) to version 1.4.0 or later.