Out-of-Bounds Read Vulnerability in ZBar by MChehab

CVE-2026-121942

What is CVE-2026-121942?

ZBar versions up to 0.23.95 contain a critical out-of-bounds read vulnerability in the function _zbar_sq_decode() located in sqcode.c. This flaw arises when attackers utilize specially crafted SQ code images that skew the finder pattern near the buffer edges. This manipulation allows the decoder to access memory locations outside the intended heap area, potentially leading to information leakage. By delivering a malformed image with unchecked sample coordinates, an attacker could crash the decoder and expose sensitive data, heightening the risk of further exploitation.

References