CVE-2026-88371

Deferred Deferred - Pending Action

Undefined Behavior in ZBar Code 128 Decoding

Publication date: 2026-09-24

Last updated on: 2026-10-06

Assigner: MITRE

Description

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-06

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-14

NVD

CVE-2026-88371

EUVD

EUVD-2026-86270

Affected Vendors & Products

Vendor	Product	Version / Range
mchehab	zbar	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-682	The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

Executive Summary

This vulnerability is an undefined behavior issue in the ZBar library's Code 128 decoder. The decode6() function left-shifts a negative value (-1) returned by decode_e() for invalid edge patterns. This violates the C standard, causing undefined behavior that can terminate the program with SIGILL in UBSan trap mode, leading to a denial of service.

Detection Guidance

To detect this vulnerability, compile ZBar with Undefined Behavior Sanitizer (UBSan) in trap mode using the flag -fsanitize-trap=undefined. Then, process a specially crafted Code 128 input that triggers the undefined behavior. If the system terminates with SIGILL (exit code 132), the vulnerability is present.

Impact Analysis

The vulnerability can cause a denial of service by crashing the ZBar library when processing specially crafted Code 128 input. This may disrupt applications relying on ZBar for barcode scanning, such as document processing or inventory systems.

Compliance Impact

This vulnerability causes a denial-of-service condition by terminating processes with SIGILL, which could disrupt critical systems handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Update ZBar to a patched version where the decode6() function properly handles the -1 return value from decode_e() before bitwise operations. Alternatively, avoid using -fsanitize-trap=undefined and switch to -fsanitize=undefined for clearer diagnostics.

Hi! I’m here to help you understand CVE-2026-88371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70