CVE-2026-88371

What it actually does

Undefined behavior triggered in decode6() when decode_e() returns -1 for an invalid Code 128 edge pattern, performing a left-shift on a negative signed integer value that can cause SIGILL termination in trap-mode UBSan instrumented builds.

Why it matters to the business

Barcode scanning applications or services built on ZBar may abruptly terminate when encountering crafted Code 128 input, resulting in operational disruption for any workflow that relies on decoding such barcodes.

How an attack unfolds

An attacker creates a specially crafted Code 128 barcode image containing an invalid edge pattern. When the vulnerable ZBar library processes the image during normal decode operations, decode_e() returns -1, decode6() performs the invalid left-shift, and the process crashes or aborts under UBSan.

How to fix it

Upgrade ZBar to a patched release that correctly handles negative return values from decode_e() before the shift operation; rebuild any dependent applications against the fixed library version and re-test barcode processing paths.

How to confirm the fix worked

Rebuild with UBSan enabled and feed the library a set of Code 128 test vectors containing invalid edge patterns; confirm absence of SIGILL or runtime errors and verify successful decode or graceful error handling on the same inputs.

Typical attack path

1. Generate a malicious Code 128 barcode image with an invalid edge pattern
2. Supply the image to any application or service that invokes ZBar's Code 128 decoder
3. Trigger decode_e() to return -1 for the crafted input
4. Execute the left-shift of the negative value inside decode6() to invoke undefined behavior and cause denial of service

How to detect it

Monitor application logs and system crash reports for SIGILL signals or abrupt terminations originating from processes that call ZBar's Code 128 decoding functions when handling barcode images.

What your security team should do

• Track ZBar upstream commits and package updates for the decode6() fix
• Isolate barcode decoding in a low-privilege process or container to limit crash impact
• Add input sanitization or size/format validation before passing images to ZBar