{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "lib/midi2/ump_stream_responder.c"
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.4.2",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "vulnerabilities@zephyrproject.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents.\n\nEndpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet \u2014 including the two uninitialised words \u2014 is transmitted verbatim by cfg-\u003esend(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts.\n\nEach discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact.\n\nThe fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed."
    },
    {
      "lang": "es",
      "value": "La biblioteca de respuesta de UMP Stream en lib/midi2/ump_stream_responder.c construye paquetes de respuesta en una estructura midi_ump de 16 bytes (uint32_t data[4]). Los constructores make_endpoint_info() y make_function_block_info() rellenan solo las dos primeras palabras (res.data[0] y res.data[1]) y, antes de esta correcci\u00f3n, declaraban su resultado como una variable local no inicializada (struct midi_ump res;). Las dos palabras restantes (res.data[2], res.data[3]) retienen contenido obsoleto de la pila.\n\nLas notificaciones de informaci\u00f3n de punto final y de bloque de funci\u00f3n son mensajes de UMP Stream (UMP_MT_UMP_STREAM), que tienen 4 palabras de longitud, por lo que el paquete completo de 16 bytes -incluyendo las dos palabras no inicializadas- es transmitido textualmente por cfg -\u003e send(). El respondedor es impulsado por solicitudes de descubrimiento de punto final / descubrimiento de bloque de funci\u00f3n de UMP Stream suministradas por el atacante a trav\u00e9s de ump_stream_respond(). En el servidor Network MIDI 2.0 integrado (subsys/net/lib/midi2/netmidi2.c), estas solicitudes llegan como datagramas UDP y, con el punto final predeterminado sin autenticaci\u00f3n, un par remoto puede establecer una sesi\u00f3n y activar las respuestas; la misma biblioteca tambi\u00e9n sirve a hosts USB MIDI 2.0.\n\nCada solicitud de descubrimiento hace que el dispositivo divulgue 8 bytes de su propia memoria de pila no inicializada al par, y la solicitud es libremente repetible. Esto es una fuga de informaci\u00f3n solo de confidencialidad (la causa ra\u00edz es el uso de una variable no inicializada, CWE-457/CWE-908); las palabras filtradas podr\u00edan incluir datos residuales o valores de puntero. No hay impacto en la corrupci\u00f3n de memoria, la integridad o la disponibilidad.\n\nLa correcci\u00f3n inicializa a cero ambas estructuras de resultado (struct midi_ump res = {0};), por lo que las palabras finales se borran antes de la transmisi\u00f3n. Estos son los \u00fanicos dos constructores de respondedores que dejaron palabras finales sin establecer (send_string() ya pone a cero su b\u00fafer), por lo que la fuga est\u00e1 completamente cerrada."
    }
  ],
  "id": "CVE-2026-13343",
  "lastModified": "2026-10-12T15:10:00.207",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "vulnerabilities@zephyrproject.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-13343",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-24T20:20:21.608785Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-24T16:16:55.530",
  "references": [
    {
      "source": "vulnerabilities@zephyrproject.org",
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/255e64bd22fcd02bd437bb0d6badac87c67de23b"
    },
    {
      "source": "vulnerabilities@zephyrproject.org",
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4w5x-w7j4-6xxc"
    }
  ],
  "sourceIdentifier": "vulnerabilities@zephyrproject.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "vulnerabilities@zephyrproject.org",
      "type": "Secondary"
    }
  ]
}