CVE-2026-13343

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13343

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13343.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13343

Aliases

GHSA-4w5x-w7j4-6xxc

Published

2026-08-24T15:43:36.665Z

Modified

2026-08-28T14:32:56.189922Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

Details

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump (uint32t data[4]). The builders makeendpointinfo() and makefunctionblockinfo() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midiump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents.

Endpoint Info and Function Block Info notifications are UMP Stream messages (UMPMTUMPSTREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via umpstream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts.

Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact.

The fix zero-initialises both result structs (struct midiump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (sendstring() already zeroes its buffer), so the leak is fully closed.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13343.json",
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "zephyr"
}

References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type

GIT

Repo

https://github.com/zephyrproject-rtos/zephyr

Events

Introduced

3568e1b6d5cdd51a6b964a2a1d6d29200fea2056

Fixed

255e64bd22fcd02bd437bb0d6badac87c67de23b

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.4.2"
        }
    ]
}

Affected versions

v4.*

v4.3.0

v4.4.0

v4.4.0-rc1

v4.4.0-rc2

v4.4.0-rc3

Database specific

vanir_signatures

[
    {
        "id": "CVE-2026-13343-7fc09805",
        "target": {
            "function": "make_function_block_info",
            "file": "lib/midi2/ump_stream_responder.c"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "319473042137286261314935565378441264561",
            "length": 620.0
        },
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/255e64bd22fcd02bd437bb0d6badac87c67de23b",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13343-891dedb2",
        "target": {
            "function": "make_endpoint_info",
            "file": "lib/midi2/ump_stream_responder.c"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "331005920418431437594468625656475816397",
            "length": 324.0
        },
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/255e64bd22fcd02bd437bb0d6badac87c67de23b",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-13343-c0a16f6b",
        "target": {
            "file": "lib/midi2/ump_stream_responder.c"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "171322162529502558433863689741312351131",
                "173541473214353049875235015427037062103",
                "323459552637991437510046112581699683377",
                "219154023740064300794351881061103389056",
                "295404652830550670293043892550563318658",
                "266086277789136195707918016971229408443",
                "312826903352315478559532990303605132044",
                "85222813731231729653405347957623660477"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/255e64bd22fcd02bd437bb0d6badac87c67de23b",
        "signature_type": "Line"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13343.json"

vanir_signatures_modified

"2026-08-28T14:32:56Z"