The flaw resides in Zephyr’s UMP Stream responder module, which builds a 16‑byte packet but only populates the first two 32‑bit words. The remaining two words contain stale stack contents that were never initialised. When a remote host sends an Endpoint‑Discovery or Function‑Block‑Discovery request, the responder sends the entire packet over the network, thus leaking 8 bytes of local stack memory. This is a confidentiality‑only disclosure identified as CWE‑200 and does not affect integrity or availability.

Zephyr RTOS (zephyrproject) is impacted through the lib/midi2/ump_stream_responder.c component. The vulnerability manifests in the in‑tree Network MIDI 2.0 server located in subsys/net/lib/midi2/netmidi2.c and also in the USB MIDI 2.0 host drivers that use the same responder. No specific version information is provided in the advisory.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, making the exact exploitation likelihood hard to quantify. The flaw is accessible over UDP without any form of authentication, allowing an attacker to freely send discovery requests that trigger the leak. Each request exposes 8 bytes of stack memory, potentially revealing residual data or pointer values. The vulnerability is not listed in CISA KEV. Because the attacker can repeatedly trigger the disclosure from a remote location, remediation should be prioritized.