CVE-2026-13343: MIDI UMP Stream Information Disclosure Flaw

CVE-2026-13343 Overview

CVE-2026-13343 is an information disclosure vulnerability in the Zephyr RTOS UMP Stream responder library at lib/midi2/ump_stream_responder.c. The builder functions make_endpoint_info() and make_function_block_info() declare a 16-byte struct midi_ump result as an uninitialized local variable and populate only the first two 32-bit words. The remaining two words retain stale stack contents and are transmitted verbatim to the requesting peer. Each Endpoint-Discovery or Function-Block-Discovery request leaks 8 bytes of the device's uninitialized stack memory, and the request is freely repeatable by an unauthenticated remote peer over the Network MIDI 2.0 UDP transport.

Critical Impact
A remote unauthenticated attacker can repeatedly leak 8 bytes of stack memory per request from Zephyr devices running the in-tree Network MIDI 2.0 server, potentially disclosing residual data or pointer values.

Affected Products

Zephyr RTOS lib/midi2/ump_stream_responder.c (UMP Stream responder library)
Zephyr in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c)
Zephyr USB MIDI 2.0 host implementations using the same responder library

Discovery Timeline

2026-08-24 - CVE-2026-13343 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13343

Vulnerability Analysis

The vulnerability stems from improper initialization of stack-allocated structures used to build UMP Stream reply packets. UMP Stream messages carry the message type UMP_MT_UMP_STREAM and are always 4 words (16 bytes) long on the wire. The responder builders make_endpoint_info() and make_function_block_info() declare struct midi_ump res; and only write res.data[0] and res.data[1]. The trailing words res.data[2] and res.data[3] remain populated with whatever stack contents preceded the call.

The responder is driven from ump_stream_respond(), which invokes cfg->send() on the full 16-byte packet. In the Network MIDI 2.0 server, discovery requests arrive as UDP datagrams. With the default no-authentication endpoint, a remote peer can establish a session and issue repeated Endpoint-Discovery and Function-Block-Discovery requests to harvest stack memory.

The root cause is classified as use of uninitialized variable [CWE-457] / [CWE-908], mapped by NVD to [CWE-200] information exposure. The leak has no memory-corruption, integrity, or availability impact.

Root Cause

The two responder builders declare struct midi_ump res; without initialization and populate only two of the four 32-bit words before returning. The send_string() helper already zero-fills its buffer, so those two builders were the only remaining leak sources in the responder.

Attack Vector

A remote peer sends a UMP Stream Endpoint-Discovery or Function-Block-Discovery request to the Zephyr Network MIDI 2.0 UDP listener. The responder replies with a 16-byte packet whose last 8 bytes contain uninitialized stack memory. USB MIDI 2.0 hosts using the same library are also affected via locally attached MIDI 2.0 peers.

// Patch: zero-initialise UMP stream notification buffers
static inline struct midi_ump make_endpoint_info(const struct ump_endpoint_dt_spec *ep)
{
-	struct midi_ump res;
+	struct midi_ump res = {0};

 	res.data[0] = (UMP_MT_UMP_STREAM << 28)
 		    | (UMP_STREAM_STATUS_EP_INFO << 16)

Source: Zephyr commit 255e64bd22fcd02bd437bb0d6badac87c67de23b

Detection Methods for CVE-2026-13343

Indicators of Compromise

Inbound UDP traffic to the Network MIDI 2.0 listener port containing UMP Stream Endpoint-Discovery or Function-Block-Discovery messages from untrusted peers.
Repeated discovery-request patterns from a single remote peer, consistent with iterative stack scraping.
Session establishment against Network MIDI 2.0 endpoints configured with no-authentication defaults.

Detection Strategies

Inspect UDP payloads for UMP packets with message type UMP_MT_UMP_STREAM and status codes matching Endpoint-Info or Function-Block-Info requests.
Correlate discovery requests with reply packets whose trailing 8 bytes exhibit high entropy across sessions, suggesting stack disclosure.
Audit Zephyr build configurations to enumerate devices that ship lib/midi2/ump_stream_responder.c prior to the fix commit.

Monitoring Recommendations

Log all Network MIDI 2.0 session establishment events and discovery-request rates per remote peer.
Alert on unauthenticated MIDI 2.0 sessions originating outside trusted network segments.
Track firmware versions across the fleet against the patched Zephyr commit to identify unremediated devices.

How to Mitigate CVE-2026-13343

Immediate Actions Required

Update Zephyr trees to include commit 255e64bd22fcd02bd437bb0d6badac87c67de23b, which zero-initializes both result structs.
Rebuild and reflash any device firmware that enables the Network MIDI 2.0 server or USB MIDI 2.0 host functionality.
Restrict network reachability of the Network MIDI 2.0 UDP listener to trusted peers only until firmware is updated.

Patch Information

The fix declares struct midi_ump res = {0}; in both make_endpoint_info() and make_function_block_info(), clearing the trailing words before transmission. See the Zephyr commit and GHSA-4w5x-w7j4-6xxc for full details.

Workarounds

Disable the Network MIDI 2.0 server (CONFIG_NET_MIDI2) in Kconfig where MIDI 2.0 networking is not required.
Enforce authentication on Network MIDI 2.0 endpoints instead of relying on the default no-authentication configuration.
Place affected devices on isolated network segments and block inbound UDP to the MIDI 2.0 listener at the perimeter.

bash

# Kconfig: disable Network MIDI 2.0 server when not required
CONFIG_NET_MIDI2=n
CONFIG_USB_DEVICE_MIDI2=n