The Matter SDK (connectedhomeip) contained a flaw before version 1.4.0 where the method GetDestinationGroupId().Value() was invoked without first verifying that a value existed. When an InvokeCommand is sent without an initialized destination group ID, the SDK aborts with SIGABRT, causing the affected device to crash and become non‑responsive. This type of uninitialized variable usage results in a runtime error that manifests as a denial of service for any client relying on the device.

All Matter SDK releases built from the connectedhomeip code base that precede commit 0360cc3 dated December 5 2024, which includes every deployment using a version earlier than 1.4.0. The issue is inherent in any project incorporating the older SDK without adding a guard around the GetDestinationGroupId() call.

The EPSS score is less than 1 %, indicating a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The description suggests that the flaw becomes apparent when an InvokeCommand is issued to a device that has not initialized the destination group ID; this is therefore the likely attack vector. Successful exploitation would cause the target device to terminate, leading to a denial‑of‑service condition for any network participants that rely on it.