CVE-2026-121942— ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c

Quick assessment

Affected

mchehab zbar

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZBar 0.23.95 及更早版本在的函数中存在一个越界读取漏洞。攻击者可利用特制的 SQ 码图像，读取图像缓冲区之外的堆内存。具体而言，攻击者可以提交一张在边缘附近包含倾斜 SQ 码定位图案的图像，从而生成未经检查的采样坐标，导致解码器崩溃，并将内存字节泄露到输出结果中。

CVSS 6.1 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c

Source: CVE Program / CVE List V5

Vulnerability Description

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mchehab	zbar	0 ~ 0.23.95	-

II. Public POCs for CVE-2026-121942

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121942

请登录查看更多情报信息。

Other References for CVE-2026-121942 (4)

https://github.com/mchehab/zbar/blob/0.23.95/zbar/sqcode.c#L529-L567 technical-description
https://github.com/mchehab/zbar/issues/351 issue-tracking
https://hackmd.io/@haindpwn/zbar-sqcode-sampling-oob-read third-party-advisory
https://www.vulncheck.com/advisories/zbar-through-0.23.95-out-of-bounds-read-via-zbar-sq-decode-in-sqcode-c third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121942

IV. Related Vulnerabilities

Same weakness: CWE-125