CVE-2025-56364 Overview
CVE-2025-56364 is a use of uninitialized value vulnerability in the Matter SDK (connectedhomeip) maintained by the Connectivity Standards Alliance (CSA). Versions before 1.4.0 call GetDestinationGroupId().Value() without first verifying whether the optional value is populated. A remote attacker can send a crafted InvokeCommand without initializing the destination group ID, triggering a SIGABRT and crashing the Matter node. The flaw affects all commits prior to 0360cc3 (December 5, 2024) and enables denial of service against smart home devices, hubs, and controllers running vulnerable Matter implementations.
Critical Impact
A single unauthenticated network request can crash any Matter-enabled device running connectedhomeip before version 1.4.0, disrupting smart home and IoT device availability.
Affected Products
- CSA-IoT Matter SDK (connectedhomeip) all versions before 1.4.0
- Matter-enabled devices built from connectedhomeip commits prior to 0360cc3
- Smart home controllers, hubs, and accessories using the vulnerable Matter Group Messaging code path
Discovery Timeline
- 2026-07-14 - CVE-2025-56364 published to the National Vulnerability Database
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2025-56364
Vulnerability Analysis
The defect [CWE-457: Use of Uninitialized Variable] resides in the Matter SDK command-invocation path. The affected code invokes GetDestinationGroupId().Value() on an Optional<> type without calling HasValue() first. When an InvokeCommand message arrives without a properly initialized destination group ID, the runtime aborts the process with SIGABRT, terminating the Matter application.
Because Matter runs across smart home hubs, thermostats, locks, lighting, and other IoT accessories, an unauthenticated remote attacker on the same network can disrupt device availability. The bug is a pure availability issue; confidentiality and integrity are not directly affected. Restart behavior depends on the device firmware, and repeated exploitation can produce persistent denial of service.
Root Cause
The root cause is missing validation on an Optional container. The Matter SDK exposes the destination group ID through a wrapper that must be checked with .HasValue() before .Value() is dereferenced. The command handler skipped this check, so any inbound command lacking the group ID caused an assertion failure. The upstream fix adds the required .HasValue() guard before accessing the underlying value.
Attack Vector
Exploitation requires network access to a target Matter node and the ability to send an InvokeCommand message. No authentication or user interaction is needed to trigger the crash on vulnerable builds. Attackers on the local IPv6 fabric, or any network segment routable to the Matter device, can repeatedly send malformed invoke requests to keep the target offline.
No public proof-of-concept exploit code is currently available. Technical details are documented in the upstream repository and the fix commit. See the connectedhomeip Pull Request #36729 and Issue #36711 for the specific code path and remediation.
Detection Methods for CVE-2025-56364
Indicators of Compromise
- Unexpected SIGABRT terminations of Matter processes or device firmware crashes logged shortly after inbound Matter traffic
- Repeated InvokeCommand messages from a single source targeting Matter nodes without a valid destination group ID
- Matter accessories or hubs entering reboot loops following network activity on the Matter operational port
Detection Strategies
- Monitor Matter device logs and crash telemetry for abort signals originating from the command dispatch code path
- Inspect network captures on the Matter fabric for malformed group-addressed InvokeCommand frames lacking a destination group ID
- Correlate device offline events with preceding inbound Matter traffic from unexpected sources on the local network
Monitoring Recommendations
- Forward IoT gateway and hub logs to a centralized logging platform and alert on repeated Matter process crashes
- Baseline normal Matter fabric traffic patterns and flag unusual bursts of InvokeCommand messages from a single endpoint
- Track firmware versions across the Matter estate and alert on devices running connectedhomeip builds prior to commit 0360cc3
How to Mitigate CVE-2025-56364
Immediate Actions Required
- Upgrade all Matter deployments to connectedhomeip version 1.4.0 or later, which contains the .HasValue() guard fix
- Inventory Matter-enabled devices and identify firmware built from commits earlier than 0360cc3 (December 5, 2024)
- Segment IoT and smart home networks from untrusted devices to limit who can send commands to Matter nodes
Patch Information
The fix is delivered in connectedhomeip Pull Request #36729, merged into the upstream repository at commit 0360cc3 on December 5, 2024. Device vendors integrating the Matter SDK must rebuild their firmware against version 1.4.0 or later and distribute updates to deployed devices. Review the connectedhomeip Repository release notes to confirm the patched version is in use.
Workarounds
- Restrict access to the Matter operational UDP port on network segments where untrusted devices exist
- Place Matter hubs and accessories behind firewalls that limit inbound traffic to known controller addresses
- Disable Matter Group Messaging functionality where not required until patched firmware is deployed
# Verify connectedhomeip version and rebuild against the patched commit
cd connectedhomeip
git fetch origin
git checkout v1.4.0
git log -1 --format=%H # confirm commit is at or after 0360cc3
./scripts/build/build_examples.py --target linux-x64-all-clusters build
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
