Use of Uninitialized Value Vulnerability in Matter SDK by Connectivity Standards Alliance

CVE-2025-56364

What is CVE-2025-56364?

A vulnerability in the Matter SDK (connectedhomeip) allows for a denial of service due to the invocation of an uninitialized value. Specifically, the issue occurs when the GetDestinationGroupId().Value() method is executed without confirming that a value has been set. In scenarios where an InvokeCommand is dispatched without properly initializing the destination group ID, the system may crash with a SIGABRT error. This vulnerability affects all versions of the SDK prior to commit 0360cc3, released on December 5, 2024. The issue is remediated by introducing a .HasValue() check prior to accessing the value.

References