CVE-2026-121942 · Package
NO FIX YET
ZBar is a barcode-reading library, and a crafted SQ code image with a skewed finder pattern near the edge makes its decoder read past the image buffer. An attacker can crash the decoder and leak heap bytes into the decoded output.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any application that decodes untrusted images with ZBar through 0.23.95 is exposed, because the flaw is triggered by the image content itself. Systems that only read barcodes from trusted, internally generated images are lower risk. unknown whether a newer ZBar version fixes it.
Not affected if no-sq-code-decoding, trusted-input-only
Who cares barcode-scanning, c-library, zbar
zbar library or a binary built on it is present, for example with zbarimg --version or by searching the dependency tree for zbar.0.23.95 or earlier, the range the sources name as affected.No fix yet, per the sources.
ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.
This page as .md · .json · in your agent: get_signal("CVE-2026-121942") · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.