CVE-2026-13343 Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-13343?
CVE-2026-13343 is a medium-severity vulnerability in zephyrproject zephyr, published on 24 Aug 2026.
Official description
The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents.
Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts.
Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact.
The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.
Weakness: CWE-200
Which versions are affected by CVE-2026-13343?
How do I fix CVE-2026-13343?
No fix has been published for CVE-2026-13343 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13343 being exploited?
There is no known exploitation of CVE-2026-13343 in the wild and no public exploit code.
Sources
Also known as GHSA-4w5x-w7j4-6xxc.