CVE-2026-88371: ZBar ZBar vulnerability
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decodee() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An attacker needs to supply specially crafted Code 128 input that causes decode_e() to return -1 for an invalid edge pattern. The resulting left shift of the negative signed value occurs in decode6().
Which deployments are most directly affected?
The described impact is termination with SIGILL in builds using UBSan trap mode. The available information does not establish whether non-trap-mode builds terminate or otherwise exhibit a security impact.
How can I determine whether an observed crash is related?
Look for a SIGILL in a UBSan trap-mode ZBar build while processing Code 128 input, with the failure involving decode6() after an invalid edge pattern causes decode_e() to return -1.