The Matter SDK contains a reachable assertion that is triggered when a command references a nonexistent endpoint or cluster. The missing validation in the command processing logic causes the code to call a verify-or-die function, which aborts the process with SIGABRT. The result is a local denial of service on the device that is running the vulnerable SDK.

Any implementation of the Matter SDK (connectedhomeip) before version 1.4.0, including embedded controllers and devices that have not applied the fix, is affected by this assertion crash.

The CVSS score is not specified, but the EPSS is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation at this time. Based on the description, the attack vector is most likely remote through the network, where an attacker can send a crafted InvokeCommandRequest to a Matter device with an invalid endpoint or cluster. The exploit does not appear to require elevated privileges, only the ability to communicate with the affected device. The resulting crash would halt the SDK, disrupting service availability until the device is restarted or the firmware is updated.