CVE-2025-56363CWE-476

CVE-2025-56363

Medium · published July 15, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00369 · 29.6th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-07-15T03:17Z
Affected products (1)
ProductVersionsFixed in
csa-iot/matter< 1.4.0.01.4.0.0
References (3)
https://github.com/project-chip/connectedhomeip/ · [email protected]https://github.com/project-chip/connectedhomeip/issues/39173 · [email protected]https://github.com/project-chip/connectedhomeip/issues/39173 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 JUL 00:00Z
    A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple…
    cvelistv5