CVE-2026-88371
Received Received - Intake

Undefined Behavior in ZBar Code 128 Decoding

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-88371
EUVD
EUVD-2026-86270

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an undefined behavior issue in the ZBar library's Code 128 decoder. The decode6() function left-shifts a negative value (-1) returned by decode_e() for invalid edge patterns. This violates the C standard, causing undefined behavior that can terminate the program with SIGILL in UBSan trap mode, leading to a denial of service.

Detection Guidance

To detect this vulnerability, compile ZBar with Undefined Behavior Sanitizer (UBSan) in trap mode using the flag -fsanitize-trap=undefined. Then, process a specially crafted Code 128 input that triggers the undefined behavior. If the system terminates with SIGILL (exit code 132), the vulnerability is present.

Impact Analysis

The vulnerability can cause a denial of service by crashing the ZBar library when processing specially crafted Code 128 input. This may disrupt applications relying on ZBar for barcode scanning, such as document processing or inventory systems.

Mitigation Strategies

Update ZBar to a patched version where the decode6() function properly handles the -1 return value from decode_e() before bitwise operations. Alternatively, avoid using -fsanitize-trap=undefined and switch to -fsanitize=undefined for clearer diagnostics.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart