CVE-2026-88371

Name of the Vulnerable Software and Affected Versions ZBar (affected versions not specified)

Description An undefined-behavior issue exists in the Code 128 decode6() function. When processing specially crafted Code 128 input, the decode e() function can return -1 for an invalid edge pattern. Subsequently, decode6() performs a left-shift operation on this negative signed value while constructing the edge signature. This operation triggers undefined behavior, which can lead to a denial of service by terminating trap-mode UBSan builds with SIGILL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.