---
id: CVE-2026-121942
title: ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c
summary: >-
  ZBar through 0.23.95 contains an out-of-bounds read vulnerability in
  _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory
  outside the image buffer via crafted SQ code images. Attackers can supply an
  image with a s…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: mchehab
product: zbar
affected:
  - zbar <= 0.23.95
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T18:52:37.472258Z'
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T18:53:01.719Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121942'
references:
  - url: 'https://github.com/mchehab/zbar/issues/351'
  - url: 'https://hackmd.io/@haindpwn/zbar-sqcode-sampling-oob-read'
  - url: 'https://github.com/mchehab/zbar/blob/0.23.95/zbar/sqcode.c#L529-L567'
  - url: >-
      https://www.vulncheck.com/advisories/zbar-through-0.23.95-out-of-bounds-read-via-zbar-sq-decode-in-sqcode-c
    label: >-
      VulnCheck Advisory: ZBar through 0.23.95 Out-of-Bounds Read via
      _zbar_sq_decode() in sqcode.c
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-05T21:36:00.508Z'
epss: 0.0024
epssPercentile: 0.15209
---

## Overview

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.

## Affected

- `zbar <= 0.23.95`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.