DEBIAN-CVE-2026-121942: Debian/zbar vulnerability
ZBar through 0.23.95 contains an out-of-bounds read vulnerability in zbarsqdecode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.
Affected Software
Event History
Frequently Asked Questions
What kind of input is required to trigger the issue?
An attacker must be able to supply a crafted image containing an SQ code with a skewed finder pattern positioned near an image edge. The malformed pattern can cause unchecked sample coordinates during SQ code decoding.
What could exploitation do in practice?
The flaw can cause the decoder to read heap memory beyond the image buffer. Reported effects include a decoder crash and leakage of heap bytes into output.
Which deployments should be prioritized for review?
Prioritize systems that use ZBar to decode SQ codes from images that may be attacker-controlled. The provided data does not identify whether any particular default configuration processes such images.