CVE-2025-56363

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H                                    

Vulnerability Description

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).

Vulnerability Details

Published Date

July 14, 2026

Last Modified

July 15, 2026

CWE ID

CWE-476

Source

NVD

External References

https://github.com/project-chip/connectedhomeip/
https://github.com/project-chip/connectedhomeip/issues/39173
https://github.com/project-chip/connectedhomeip/issues/39173

CVE-2025-56363

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment