CVE-2026-88371 Details
Description
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.
A vulnerability has been identified in the ZBar library, specifically in the Code 128 decoding function 'decode6()'. This issue arises from an undefined behavior vulnerability when processing specially crafted Code 128 input. The 'decode_e()' function can return -1 for invalid edge patterns, and 'decode6()' subsequently left-shifts this negative value while constructing the edge signature. This operation invokes undefined behavior, which can cause the program to terminate unexpectedly in builds with Undefined Behavior Sanitizer (UBSan) trap mode enabled, resulting in a denial-of-service condition.
Users can update to the latest version of ZBar, where this vulnerability has been addressed by modifying the 'decode6()' function to check the 'decode_e()' results before performing any bit shifts. Instructions for updating can be found in the ZBar repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mchehab/zbar/issues/336 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| mchehab/zbar | 2ea2ca58 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |