Matter Chip CVE-2026-78806

Requires local access (AV:L) to a host or device running the Matter connectedhomeip controller (ChipDeviceController) with at least low privileges (PR:L), and the flaw is exercised through the PerformCommissioningStep code path - i.e. during or around device commissioning to a Matter fabric. No user interaction is needed (UI:N). Limiting factors: exploitation is confined to the local commissioning device (not remotely reachable), the attacker must already hold a foothold with low privileges, and impact is confidentiality-only (I:N/A:N) - the attacker reads sensitive commissioning information but cannot modify or disrupt the device via this issue.

Signals point to a genuine but low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-privilege, confidentiality-only information disclosure - not a remotely weaponizable flaw. EPSS reinforces this: 0.15% probability at the 4th percentile, i.e. exploitation is not expected in the wild. The CVE is not on CISA KEV, so there is no confirmed active exploitation. No explicit POC flag is set in the input; however, one reference is a suspicious third-party repo (github.com/Anonymous241429/Matter) that may host proof-of-concept material - this is unverified and should NOT be treated as confirmed exploit code. The signals are internally consistent (local vector + very low EPSS + no KEV = not a mass-exploitation priority). The main caveat is data quality, not signal conflict: the CPE is a null placeholder (cpe:2.3:a:n/a:n/a) and affected versions are 'n/a', so the precise affected component boundary is asserted only by the description text (Matter/connectedhomeip v1.5.1) rather than structured NVD data - verify the exact SDK build with the project-chip repository.

A local attacker with low-privilege access to a device or host running the Matter connectedhomeip controller observes the PerformCommissioningStep routine in ChipDeviceController.cpp and reads sensitive commissioning data it exposes due to a spec-vs-implementation gap. Because the vector is local and requires existing low privileges (no user interaction), the practical path is a co-resident process or logged-in user on the commissioning device rather than a remote network attacker. A referenced anonymous GitHub repo may contain PoC material, but its status is unconfirmed.