CVE-2025-56364CWE-457

CVE-2025-56364

Medium · published July 15, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID. The issue affects all versions before commit 0360cc3 (Dec 5, 2024) and leads to denial of service through SIGABRT. It is fixed by adding a .HasValue() check before access.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Weakness
CWE-457 · Use of Uninitialized Variable
Published
2026-07-15T03:17Z
Affected products (1)
ProductVersionsFixed in
csa-iot/matter< 1.4.0.01.4.0.0
References (4)
https://github.com/project-chip/connectedhomeip/ · [email protected]https://github.com/project-chip/connectedhomeip/issues/36711 · [email protected]https://github.com/project-chip/connectedhomeip/pull/36729 · [email protected]https://github.com/project-chip/connectedhomeip/issues/36711 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 JUL 00:00Z
    A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is…
    cvelistv5