ZBar 0.23.90 vulnerabilities
3 known CVE vulnerabilities in ZBar 0.23.90, translated and rated.
- CVE-2026-88371Unknown
In the ZBar library, the decode6() function for Code 128 barcodes contains an undefined-behavior vulnerability. When decode_e() returns -1 for an invalid edge pattern, decode6() left-shifts this negative signed value, which is undefined behavior. This can cause a crash (SIGILL) in UBSan builds, leading to denial of service.
- CVE-2023-40890Critical
A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.
- CVE-2023-40889Critical
A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.