CVE-2026-13343

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents. Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts. Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact. The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.

• CWE-200

• https://github.com/zephyrproject-rtos/zephyr/commit/255e64bd22fcd02bd437bb0d6badac87c67de23b
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4w5x-w7j4-6xxc

Published

Aug 24, 2026

Last Modified

Aug 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13337CWE-564: SQL Injection: Hibernate vulnerability exists that …5.1
• CVE-2026-13339The CubeWP Framework plugin for WordPress is vulnerable to D…7.5
• CVE-2026-1334An Out-Of-Bounds Read vulnerability affecting the EPRT file …7.8
• CVE-2026-13340The SVG Support WordPress plugin before 2.5.17 does not appl…6.1
• CVE-2026-13341A vulnerability exists in the Kong Konnect Model Context Pro…7.4
• CVE-2026-13342The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 …5.3
• CVE-2026-13344The Essential Addons for Elementor WordPress plugin before …4.8
• CVE-2026-13345The Essential Addons for Elementor WordPress plugin before …5.3
• CVE-2026-13346pip would incorrectly handle doubly-encoded package URLs fro…6.5
• CVE-2026-13347The Hide My WP Lite plugin for WordPress is vulnerable to Ar…7.5
• CVE-2026-13348CWE-307: Improper Restriction of Excessive Authentication At…6.9
• CVE-2026-1335An Out-Of-Bounds Write vulnerability affecting the EPRT file…7.8