CVE-2026-88371

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service.

• https://github.com/mchehab/zbar/issues/336

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88366NanoSVG commit 239e102ec contains an incorrect numeric conve…
• CVE-2026-88367NanoSVG 239e102ec contains an incorrect numeric conversion v…6.5
• CVE-2026-88368NanoSVG commit 239e102ec contains an incorrect numeric conve…7.5
• CVE-2026-88369zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow …7.3
• CVE-2026-8837The WP Iframe Geo Style for Amazon affiliates plugin for Wor…6.4
• CVE-2026-88370libconfini 1.16.4 contains a heap out-of-bounds write condit…5.3
• CVE-2026-88372libsndfile 1.2.2 contains an integer overflow vulnerability …7.5
• CVE-2026-88373libde265 commit 4d45a6b contains a NULL pointer dereference …7.5
• CVE-2026-88376Bento4 1.6.0.0 contains an integer underflow vulnerability i…7.5
• CVE-2026-88377Bento4 1.6.0.0 contains an integer underflow vulnerability i…
• CVE-2026-88378QuickJS commit 04be24600 contains a heap out-of-bounds write…
• CVE-2026-8838Unsafe use of Python's eval() on server-received data in the…9.8