zbar: ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function
CVE-2026-88371 is fixed in zbar on 1 platform by DEBIAN-CVE-2026-88371 (version 0.23.95-1), released September 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| zbar · Debian 14 | 0.23.95-1 | DEBIAN-CVE-2026-88371 | Sep 24, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.