CVE-2026-13343
Received Received - Intake

UMP Stream Responder Library Information Leak

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Zephyr Project

Description
The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents. Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts. Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact. The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-13343
EUVD
EUVD-2026-64924

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zephyrproject network_midi 0
zephyrproject zephyr From 4.3.0 (inc) to 4.4.1 (inc)
zephyrproject zephyr 4.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-13343 is a confidentiality-only information leak in the Zephyr RTOS MIDI 2.0 UMP Stream responder library. It occurs in two functions, make_endpoint_info() and make_function_block_info(), which build 16-byte reply packets but only initialize the first two 32-bit words. The remaining two words retain uninitialized stack memory, which is transmitted verbatim in UMP Stream messages. Each discovery request leaks 8 bytes of stack memory to the peer.

Detection Guidance

To detect this vulnerability, monitor network traffic for UMP Stream messages from affected systems. Use Wireshark to capture UDP traffic on ports used by Network MIDI 2.0 and inspect packets for malformed or incomplete UMP Stream messages. Check system logs for repeated Endpoint-Discovery or Function-Block-Discovery requests.

Impact Analysis

An attacker can remotely trigger discovery requests via UDP or USB, repeatedly disclosing 8 bytes of uninitialized stack memory per request. This could expose residual data or pointers, but does not affect memory corruption, integrity, or availability. The impact is limited to potential confidentiality breaches of stack contents.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA due to the potential disclosure of uninitialised stack memory containing residual data or pointers. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. The leak of 8 bytes of stack memory per request could expose sensitive information, violating confidentiality requirements in these regulations.

Mitigation Strategies

Immediately update Zephyr RTOS to version 4.4.2 or later. If updating is not possible, apply the patch from the official Zephyr commit 255e64bd22fcd02bd437bb0d6badac87c67de23b. Disable unauthenticated Network MIDI 2.0 endpoints if they are not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13343. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart