CVE-2023-40890
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
Risk Assessment
This vulnerability may allow an attacker to gain access to sensitive data or execute arbitrary code remotely, posing a serious security threat to the system.
Recommendation
It is recommended to update ZBar to the latest version to mitigate this vulnerability and to implement filtering of QR codes before processing.
Original NVD description (English source)
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.