CVE-2025-56364

Katalog CVE

CVSS 5.7 · Medium EPSS 0,21%

Kerentanan Use of Uninitialized Variable pada csa-iot matter. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID. The issue affects all versions before commit 0360cc3 (Dec 5, 2024) and leads to denial of service through SIGABRT. It is fixed by adding a .HasValue() check before access.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-457: Use of Uninitialized Variable

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/project-chip/connectedhomeip/pull/36729 patch
• https://github.com/project-chip/connectedhomeip/ product
• https://github.com/project-chip/connectedhomeip/issues/36711 issue tracking