The UMP Stream responder library in Zephyr's lib/midi2/ump_stream_responder.c constructs 16-byte reply packets using a struct midi_ump. Two builder functions, make_endpoint_info() and make_function_block_info(), previously declared their result struct uninitialized, leaving the last 8 bytes of the 16-byte packet with stale stack data. These packets are sent in response to UMP Stream Endpoint-Discovery and Function-Block-Discovery requests, which can be triggered remotely via UDP datagrams without authentication in the Network MIDI 2.0 server. Each request leaks 8 bytes of uninitialized stack memory to the requester. The vulnerability is a confidentiality-only information leak (CWE-457/CWE-908) with no impact on integrity or availability. The issue is fixed by zero-initializing the result structs, ensuring no stale data is transmitted.

An unauthenticated remote attacker can repeatedly send discovery requests to a Zephyr device running the affected MIDI 2.0 server, causing the device to leak 8 bytes of uninitialized stack memory per response. This information leak could disclose residual stack data or pointer values, potentially aiding further attacks. There is no memory corruption, integrity compromise, or denial of service impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves zero-initializing the local structs in the affected functions to prevent leaking uninitialized stack data. Until an official patch is available, consider restricting access to the MIDI 2.0 endpoint or disabling the affected functionality if feasible.