CVE-2025-56363: n/a
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0 in the ReadRevisionAttribute function used by multiple clusters. The function does not properly validate a delegate pointer before dereferencing it. A remote unauthenticated attacker can exploit this by sending a crafted read request, causing the device to crash and resulting in denial of service. This issue is confirmed in SDK version 1.4.0.
AI Analysis
Technical Summary
CVE-2025-56363 is a null pointer dereference vulnerability in the Matter SDK (connectedhomeip) affecting versions prior to 1.4.0. The vulnerability occurs in the ReadRevisionAttribute function, which is used across multiple clusters such as Channel, Account Login, and TargetNavigator. The function fails to validate the delegate pointer before dereferencing it, allowing a remote unauthenticated attacker to send a specially crafted read request that triggers a crash of the device, causing denial of service. The vulnerability has been confirmed in SDK version 1.4.0 (commit ab3d5ae). No CVSS score or official remediation level is provided.
Potential Impact
Exploitation of this vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the affected device. There is no indication of code execution or data disclosure. The impact is limited to device availability disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is confirmed in versions before 1.4.0 and the issue is noted in version 1.4.0, upgrading to version 1.4.0 or later may address the issue. Monitor vendor communications for an official fix or update.
CVE-2025-56363: n/a
Description
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0 in the ReadRevisionAttribute function used by multiple clusters. The function does not properly validate a delegate pointer before dereferencing it. A remote unauthenticated attacker can exploit this by sending a crafted read request, causing the device to crash and resulting in denial of service. This issue is confirmed in SDK version 1.4.0.
Affected software
pkg:github/project-chip/connectedhomeipRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-56363 is a null pointer dereference vulnerability in the Matter SDK (connectedhomeip) affecting versions prior to 1.4.0. The vulnerability occurs in the ReadRevisionAttribute function, which is used across multiple clusters such as Channel, Account Login, and TargetNavigator. The function fails to validate the delegate pointer before dereferencing it, allowing a remote unauthenticated attacker to send a specially crafted read request that triggers a crash of the device, causing denial of service. The vulnerability has been confirmed in SDK version 1.4.0 (commit ab3d5ae). No CVSS score or official remediation level is provided.
Potential Impact
Exploitation of this vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the affected device. There is no indication of code execution or data disclosure. The impact is limited to device availability disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is confirmed in versions before 1.4.0 and the issue is noted in version 1.4.0, upgrading to version 1.4.0 or later may address the issue. Monitor vendor communications for an official fix or update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2025-08-16T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a56b92768715ace4351a779
Added to database: 07/14/2026, 22:33:11 UTC
Last enriched: 07/14/2026, 22:48:25 UTC
Last updated: 07/14/2026, 22:50:13 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.