{"id":"CVE-2026-121942","kind":"vulnerability","aliases":["CVE-2026-121942"],"related":[],"title":"ZBar: crafted SQ code image reads heap memory out of bounds","description":"ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.","summary":"ZBar is a barcode-reading library, and a crafted SQ code image with a skewed finder pattern near the edge makes its decoder read past the image buffer. An attacker can crash the decoder and leak heap bytes into the decoded output.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["barcode-scanning","c-library","package","zbar"],"not_affected_if":["no-sq-code-decoding","trusted-input-only"],"how_to_check":"- Check whether the `zbar` library or a binary built on it is present, for example with `zbarimg --version` or by searching the dependency tree for `zbar`.\n- Confirm the version is `0.23.95` or earlier, the range the sources name as affected.","fix":null,"status":"open","published_at":"2026-11-04T13:17:28+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","triaged_at":"2026-11-04T13:28:05+00:00","updated_at":"2026-11-04T13:28:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-04T13:28:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ZBar: crafted SQ code image reads heap memory out of bounds","impact":"low","summary":"ZBar is a barcode-reading library, and a crafted SQ code image with a skewed finder pattern near the edge makes its decoder read past the image buffer. An attacker can crash the decoder and leak heap bytes into the decoded output.","audience":"developers","category":"package","nicknames":[],"who_cares":["zbar","barcode-scanning","c-library"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Heap memory leaks into output and the decoder crashes","analyst_note":"Sources give no fixed version or patch; check the ZBar project and the VulnCheck advisory (www.vulncheck.com) for a fix and for whether SQ code decoding is the only trigger.","how_to_check":"- Check whether the `zbar` library or a binary built on it is present, for example with `zbarimg --version` or by searching the dependency tree for `zbar`.\n- Confirm the version is `0.23.95` or earlier, the range the sources name as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-sq-code-decoding"],"who_is_affected":"Any application that decodes untrusted images with ZBar through 0.23.95 is exposed, because the flaw is triggered by the image content itself. Systems that only read barcodes from trusted, internally generated images are lower risk. unknown whether a newer ZBar version fixes it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4200,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121942':14A,17A '-2026':13A,16A '0.23.95':71C 'allow':87C 'attack':56B,88C,102C 'barcod':19B,30B 'barcode-read':29B 'barcode-scan':18B 'bound':11A,77C 'buffer':54B,96C 'byte':64B,127C 'c':22B 'c-librari':21B 'code':4A,37B,100C,111C 'contain':72C 'coordin':120C 'craft':2A,35B,98C 'crash':58B,122C 'cve':12A,15A 'decod':49B,60B,67B,83C,124C 'edg':46B,116C 'finder':42B,112C 'heap':7A,63B,91C 'imag':5A,38B,53B,95C,101C,106C 'leak':62B,126C 'librari':23B,32B 'make':47B 'memori':8A,92C 'near':44B,114C 'out-of-bound':74C 'output':68B,129C 'outsid':93C 'packag':24B 'past':51B 'pattern':43B,113C 'produc':117C 'read':6A,31B,50B,78C,90C 'sampl':119C 'scan':20B 'skew':41B,109C 'sq':3A,36B,82C,99C,110C 'suppli':104C 'uncheck':118C 'via':97C 'vulner':79C 'zbar':1A,25B,26B,69C,81C 'zbar/sqcode.c':85C","nicknames":[],"mitigations":[],"who_affected":"Any application that decodes untrusted images with ZBar through 0.23.95 is exposed, because the flaw is triggered by the image content itself. Systems that only read barcodes from trusted, internally generated images are lower risk. unknown whether a newer ZBar version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["barcodescanning","clibrary","medium","package","zbar"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121942","severity":null,"published_at":"2026-11-04T13:17:28+00:00","modified_at":"2026-11-04T13:17:28+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","fetched_at":"2026-11-04T13:27:03+00:00","note":null}],"documents":[{"id":67089,"url":"https://www.vulncheck.com/advisories/zbar-through-0.23.95-out-of-bounds-read-via-zbar-sq-decode-in-sqcode-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}