Executive brief
The UMP Stream responder library in Zephyr handles MIDI 2.0 protocol messages. A flaw causes the library to leak uninitialized stack memory (up to 8 bytes per request) when responding to endpoint and function block discovery queries, which can be triggered remotely over the network in the default configuration. An attacker can repeatedly trigger these requests to extract sensitive memory contents, potentially revealing pointers or other confidential data, though this does not enable code execution or service disruption.
Technical details
The vulnerability is a use of uninitialized variable (CWE-457/CWE-908) in the UMP Stream responder builders make_endpoint_info() and make_function_block_info() in lib/midi2/ump_stream_responder.c. These functions construct 16-byte UMP packets (struct midi_ump with four uint32_t words) but only populate the first two words; the remaining two words retain stale stack memory contents. The functions are called via ump_stream_respond() when handling UMP Stream Endpoint-Discovery or Function-Block-Discovery requests. In the Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c), these requests arrive as UDP datagrams from remote peers and are processed without authentication by default. The full 16-byte packet, including the uninitialized trailing words, is transmitted via cfg->send(). The fix zero-initializes both result structs (struct midi_ump res = {0};) so trailing words are cleared before transmission. No memory corruption, integrity, or availability impact is present; this is purely an information disclosure issue.
Affected products
- Zephyr Zephyr RTOS <unspecified versions prior to fix
Timeline
- 2026-08-24: disclosed
- other: CVE-2026-13343 assigned