CVE-2026-88371
UnknownSummary
In the ZBar library, the decode6() function for Code 128 barcodes contains an undefined-behavior vulnerability. When decode_e() returns -1 for an invalid edge pattern, decode6() left-shifts this negative signed value, which is undefined behavior. This can cause a crash (SIGILL) in UBSan builds, leading to denial of service.
Risk Assessment
The risk includes the possibility of crashing applications that use ZBar when processing specially crafted barcodes, which could be exploited for DoS attacks. This affects service availability.
Recommendation
Update ZBar to a patched version, or if unavailable, restrict trust in processed input. Also consider builds with additional hardening.
Other vulnerabilities in ZBar
See all- CVE-2023-40890Critical
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
- CVE-2023-40889Critical
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
Original NVD description (English source)
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.