Executive brief
The Matter SDK, an open-source framework for smart home device connectivity, contains a flaw that can cause devices to crash. By sending a specifically malformed network message, an attacker can trigger a software failure that forces the device to restart or stop responding. This results in a temporary loss of control over smart home hardware like lights, locks, or thermostats.
Technical details
A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The root cause is located in the ExchangeManager where the `GetDestinationGroupId().Value()` method is invoked on a packet header without a preceding `.HasValue()` check. An attacker can trigger this by sending a malformed Groupcast message or an InvokeCommand that lacks an initialized destination group ID. This leads to a SIGABRT crash, resulting in a denial of service. The issue was addressed in commit 0360cc3 by implementing the necessary validation check before accessing the group ID value.
Affected products
- Connectivity Standards Alliance Matter SDK (connectedhomeip) before 1.4.0
Timeline
- 2024-12-04: disclosed: Issue reported on GitHub
- 2024-12-05: patched: Fix merged into master branch via commit 0360cc3
- 2026-07-14: advisory: CVE-2025-56364 published