Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-13343— Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 在 中的 UMP Stream 响应库，使用一个 16 字节的 （由 组成）来构建回复数据包。函数 和 仅填充前两个字（即 和 ），而在修复之前，它们将结果声明为未初始化的局部变量（ ）。因此，剩余的两个字（ 和 ）会保留栈上残留的旧数据。 Endpoint Info 和 Function Block Info 通知属于 UMP Stream 消息（ ），长度为 4 个字（16 字节）。因此，整个 16 字节的数据包——包括两个未初始化的字——会通过 原封不动地发送出去。该响应器由

CVSS 5.3 · Medium EPSS 0.23% · P14

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.3.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13343

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder
Source: CVE Program / CVE List V5
Vulnerability Description
The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents. Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts. Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact. The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.3.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-13343

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13343

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13343 (1)

Vendor Advisories for CVE-2026-13343 (1)

Same Patch Batch · zephyrproject · 2026-08-24 · 4 CVEs total

CVE-2026-13212 8.8 HIGH Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring de
CVE-2026-9728 6.4 MEDIUM TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
CVE-2026-13213 5.3 MEDIUM Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_re

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-200

V. Comments for CVE-2026-13343

No comments yet

Leave a comment