CVE-2026-88371
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the ZBar library, the decode6() function for Code 128 barcodes contains an undefined-behavior vulnerability. When decode_e() returns -1 for an invalid edge pattern, decode6() left-shifts this negative signed value, which is undefined behavior. This can cause a crash (SIGILL) in UBSan builds, leading to denial of service.
Risk Assessment
The risk includes the possibility of crashing applications that use ZBar when processing specially crafted barcodes, which could be exploited for DoS attacks. This affects service availability.
Recommendation
Update ZBar to a patched version, or if unavailable, restrict trust in processed input. Also consider builds with additional hardening.
Other vulnerabilities in ZBar
See all- CVE-2026-121942Medium
ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.
- CVE-2023-40890Critical
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
- CVE-2023-40889Critical
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
Original NVD description (English source)
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS