Zephyr RTOS CVE-2026-13343

The Network MIDI 2.0 server feature must be explicitly compiled into the Zephyr image via its Kconfig option - it is not enabled in default builds, which substantially narrows the exposed population. Once enabled, the default no-authentication endpoint configuration allows any remote peer to establish a session without credentials, making exploitation unauthenticated over UDP. Limits on exploitation include: (1) the feature must be opt-in compiled, (2) authenticated endpoint configurations would require valid session establishment first, (3) the USB MIDI 2.0 path requires physical device access. Affected version range is Zephyr 4.3.0 through 4.4.1 inclusive - devices on 4.4.2 or later are not affected.

The NVD CVSS 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the description: on default-configured Network MIDI 2.0 endpoints no authentication is required, and the impact is strictly confidentiality-limited to 8 bytes of stack memory per request. The repeatable nature of the request is a meaningful amplifier - a patient remote peer could gather many samples and potentially reconstruct pointer values useful for ASLR bypass in a chained attack, though this escalation path is speculative and not confirmed by any source. No EPSS score was supplied in the input, and no KEV listing is present, indicating no confirmed active exploitation. The real-world risk is bounded by deployment footprint: the Network MIDI 2.0 feature is an opt-in, non-default Kconfig option, so affected devices constitute a subset of already-niche Zephyr deployments. The USB MIDI 2.0 path requires physical device access, further limiting that vector. Overall, this is a genuine but low-urgency finding for most environments.

A remote attacker on any UDP-reachable network sends Endpoint-Discovery or Function-Block-Discovery datagrams to a Zephyr device running the default unauthenticated Network MIDI 2.0 endpoint. Each request elicits a reply packet containing 8 bytes of uninitialised kernel stack contents; repeating the request across multiple call contexts allows accumulation of stack samples potentially including residual data or pointer values. No public exploit code has been identified, but the attack requires only standard UDP socket operations and familiarity with the UMP Stream protocol.