Description
The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents.

Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts.

Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact.

The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.
Published: 2026-08-24
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the UMP Stream responder within Zephyr's MIDI 2.0 library; builder functions create a 16‑byte packet but only initialise the first two 32‑bit words, leaving the remaining two words filled with stale stack data. When a remote peer issues a UART or UDP Endpoint‑Discovery or Function‑Block‑Discovery request, the entire packet—including the uninitialised words—is transmitted, leaking 8 bytes of local stack contents. This results in a confidentiality‑only impact under CWE‑200, with no integrity or availability consequences.

Affected Systems

Zephyr RTOS (zephyrproject) is affected, specifically the lib/midi2/ump_stream_responder.c component used in both the in‑tree Network MIDI 2.0 server and USB MIDI 2.0 host drivers. Version information is not specified in the advisory.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is unavailable, so the likelihood of exploitation cannot be quantified precisely. However, the flaw is reachable over UDP without requiring authentication; a remote attacker can freely send the discovery requests that trigger the leak. Since the leak could expose residual data or pointers from the device stack, sensitive information may be disclosed. The vulnerability is not listed in CISA KEV, yet the remote‑only nature warrants careful monitoring and timely patching.

Generated by OpenCVE AI on August 24, 2026 at 17:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Zephyr to the latest revision that contains the zero‑initialisation fix in ump_stream_responder.c
  • If immediate upgrade is not possible, disable unauthenticated UMP Stream discovery for Network MIDI by configuring the system to reject or ignore unsolicited discovery requests
  • Apply network filtering or firewall rules to restrict UDP traffic to the MIDI 2.0 port from trusted hosts only
  • Verify that all local variable initialisation is performed before data is transmitted or stored

Generated by OpenCVE AI on August 24, 2026 at 17:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 24 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents. Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts. Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact. The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.
Title Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-24T15:43:36.665Z

Reserved: 2026-06-25T14:13:05.267Z

Link: CVE-2026-13343

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T16:16:55.530

Modified: 2026-08-24T16:16:55.530

Link: CVE-2026-13343

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T17:30:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor