Executive brief
A security flaw has been identified in the Matter SDK, an open-source software framework used to connect smart home devices from different manufacturers. An attacker can send a specially crafted network request to a vulnerable device, such as a smart TV or media player, causing the device to crash and restart. This results in a denial-of-service, making the smart home equipment temporarily unavailable for use.
Technical details
A null pointer dereference exists in the 'ReadRevisionAttribute' function within the Matter SDK (connectedhomeip). The vulnerability is caused by a lack of validation for the 'delegate' pointer before it is dereferenced in multiple clusters, including Channel, Account Login, TargetNavigator, ContentLauncher, and MediaPlayback. A remote, unauthenticated attacker can trigger this flaw by sending a crafted attribute read request (e.g., via chip-tool) to a vulnerable endpoint. This results in a segmentation fault (SEGV) and subsequent device crash. The issue is addressed in version 1.4.0 of the SDK.
Affected products
- Project CHIP Matter SDK (connectedhomeip) before 1.4.0
Timeline
- 2025-05-25: disclosed: Issue reported on GitHub
- 2026-07-14: advisory: CVE published