CVE-2026-13343

Name of the Vulnerable Software and Affected Versions UMP Stream responder library (affected versions not specified)

Description An information leak exists in the UMP Stream responder library within lib/midi2/ump stream responder.c. The functions make endpoint info() and make function block info() use an uninitialised local variable res of type struct midi ump. Because these functions only populate the first two words of the 16-byte structure, the remaining two words (res.data[2] and res.data[3]) retain stale stack contents. When UMP Stream messages are transmitted via cfg->send(), these uninitialised words are sent to the peer. A remote attacker can trigger this by sending UMP Stream Endpoint-Discovery or Function-Block-Discovery requests through ump stream respond(). In the Network MIDI 2.0 server, these requests are received as UDP datagrams, allowing a remote peer to disclose 8 bytes of uninitialised stack memory, which may include residual data or pointer values.

Recommendations Zero-initialise the result structs in make endpoint info() and make function block info() by declaring them as struct midi ump res = {0}; to ensure trailing words are cleared before transmission.