ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked sample coordinates that crash the decoder and leak bytes into output.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/mchehab/zbar/issues/351 Üçüncü taraf
• hackmd.io/@haindpwn/zbar-sqcode-sampling-oob-read Üçüncü taraf
• vulncheck.com/…-of-bounds-read-via-zbar-sq-decode-in-sqcode-c Üçüncü taraf
• github.com/mchehab/zbar/blob/0.23.95/zbar/sqcode.c Diğer
• hackmd.io/…/cve-2026-121942-zbar-sqcode-sampling-oob-read Diğer

Kayıt geçmişi

1. 4 Kas 2026 15:31Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-116782FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
• 2,7 CVE-2026-116780FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing
• 7,5 CVE-2026-116784FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing
• 7,5 CVE-2026-116568FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
• 8,1 CVE-2026-76077ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()
• 5,3 CVE-2026-75615ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders