A high severity null pointer dereference vulnerability in the Matter SDK (connectedhomeip) prior to version 1.4.0 allows unauthenticated remote attackers to crash vulnerable devices, resulting in a denial of service.

This flaw is a null pointer dereference issue located in the ReadRevisionAttribute function across multiple clusters. The function fails to validate the delegate pointer before dereferencing it, which can be triggered by an unauthenticated remote attacker sending a crafted read request.

A successful exploitation of this vulnerability results in a complete crash of affected smart home and Internet of Things devices, leading to a denial of service. This can disrupt critical device operations and require physical or remote reboots, causing operational downtime. The CVSS score of 7.5 reflects the high severity of network-based availability disruption requiring no user interaction or privileges.

Immediate Action: Update the Matter SDK (connectedhomeip) to version 1.4.0 or later, or apply the upstream fix commit 43aa98c2d30ee547c6b587b9de7bbb794f175ece.

Proactive Monitoring: Monitor network traffic for anomalous read requests targeting Matter clusters and track device availability metrics to detect unexpected reboots or crashes.

Compensating Controls: Implement network segmentation to isolate Matter-enabled IoT devices from untrusted networks and restrict external access to device management interfaces.

Public Exploit Available: No (As of the available data, no weaponized exploit or public PoC is confirmed, though CISA SSVC assessment lists a poc status).

Security teams and device manufacturers utilizing the Matter SDK must prioritize updating to version 1.4.0 immediately. Applying this patch removes the crash vector and prevents potential denial of service attacks against connected hardware infrastructure.