EUVD-2025-210472

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster e.g., 0x34, the code incorrectly treats the endpoint as valid due to missing...

CVE-2025-56364

A use of uninitialized value vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, where the GetDestinationGroupId.Value method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID...

CVE-2025-56365

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster e.g., 0x34, the code incorrectly treats the endpoint as valid due to missing...

CVE-2025-56365

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster e.g., 0x34, the code incorrectly treats the endpoint as valid due to missing...

CVE-2025-56365

The Matter SDK (connectedhomeip) versions prior to 1.4.0 are vulnerable to a reachable assertion vulnerability within the interaction model command processing logic. The root cause is a missing check in CodegenDataModelProvider::Invoke , which allows the system to incorrectly treat an InvokeComma...

CVE-2025-56364

The Matter SDK (connectedhomeip) versions prior to 1.4.0 (specifically before commit 0360cc3 ) are vulnerable to a use of uninitialized value. The flaw occurs because the GetDestinationGroupId().Value() method is invoked without verifying if a value exists. If an InvokeCommand is sent without an ...

CVE-2003-0837: Undefined Security Weakness

Stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 for Windows, before Fixpak 10a, allows attackers with "Connect" privileges to execute arbitrary code via the INVOKE command...