CVE-2025-56363 Null dereference in n/a

Medium 5.7 Published 14 Jul 2026 Updated 5 Oct 2026

A remote unauthenticated attacker can crash Matter devices by sending crafted read requests due to a null pointer dereference in the SDK.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-56363?

CVE-2025-56363 is a medium-severity vulnerability in n/a, published on 14 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).

Weakness: CWE-476

Which versions are affected by CVE-2025-56363?

It affects 1 product.

Products include Csa-Iot Matter.

How do I fix CVE-2025-56363?

No fix has been published for CVE-2025-56363 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-56363 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56363 exists.

Sources

Also known as GHSA-mv6q-v23c-9757.