Description
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
Published: 2026-07-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Matter SDK contains a reachable assertion that is triggered when a command references a nonexistent endpoint or cluster. The missing validation in the command processing logic causes the code to call a verify-or-die function, which aborts the process with SIGABRT. The result is a local denial of service on the device that is running the vulnerable SDK.

Affected Systems

Any implementation of the Matter SDK (connectedhomeip) before version 1.4.0, including embedded controllers and devices that have not applied the fix, is affected by this assertion crash.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation at this time. Based on the description, the attack vector is most likely remote via the network, where an attacker can send a crafted InvokeCommandRequest to a Matter device with an invalid endpoint or cluster. The exploit does not appear to require elevated privileges, only the ability to communicate with the affected device. The resulting crash would halt the SDK, disrupting service availability until the device is restarted or the firmware is updated.

Generated by OpenCVE AI on August 13, 2026 at 12:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to connectedhomeip version 1.4.0 or later, which includes proper endpoint and cluster validation.
  • If updating the SDK is not immediately possible, apply the source code fix from PR #37207 to add the missing checks before invoking command logic.
  • Limit exposure by filtering or monitoring Matter traffic on the network, isolating controllers and devices until the patch is applied.

Generated by OpenCVE AI on August 13, 2026 at 12:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Title Matter SDK Assertion Crash from Invalid Endpoint or Cluster

Wed, 12 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Matter SDK Assertion Crash from Invalid Endpoint or Cluster
Weaknesses CWE-20

Wed, 05 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Assertion Crash in Matter SDK Command Processing due to Missing Endpoint Validation
Weaknesses CWE-20

Tue, 04 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Title Assertion Crash in Matter SDK Command Processing due to Missing Endpoint Validation
Weaknesses CWE-370
CWE-398

Sat, 01 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Title Matter SDK Assertion Crash on Nonexistent Endpoint
Weaknesses CWE-370
CWE-398

Wed, 29 Jul 2026 07:00:00 +0000

Type Values Removed Values Added
Title Matter SDK Assertion Crash on Nonexistent Endpoint
Weaknesses CWE-20
CWE-742

Sat, 25 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title Reachable Assertion in Matter SDK Command Processing Leading to Crash

Wed, 22 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Title Reachable Assertion in Matter SDK Command Processing Leading to Crash
Weaknesses CWE-20
CWE-742

Fri, 17 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title Matter SDK Crash via Unchecked Endpoint in InvokeCommandRequest
Weaknesses CWE-682

Thu, 16 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Matter SDK Crash via Unchecked Endpoint in InvokeCommandRequest
Weaknesses CWE-682

Tue, 14 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
References

Subscriptions

Csa-iot Matter
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-15T14:17:52.828Z

Reserved: 2025-08-16T00:00:00.000Z

Link: CVE-2025-56365

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-14T23:17:27.593

Modified: 2026-07-17T03:19:43.137

Link: CVE-2025-56365

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T13:00:04Z

Weaknesses