Hi,

The following vulnerability was published for zbar.

CVE-2026-88371[0]:
| ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in
| the Code 128 decode6() function. When processing specially crafted
| Code 128 input, decode_e() can return -1 for an invalid edge
| pattern, and decode6() subsequently left-shifts this negative signed
| value while constructing the edge signature. The operation invokes
| undefined behavior and can terminate trap-mode UBSan builds with
| SIGILL, resulting in denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88371
https://www.cve.org/CVERecord?id=CVE-2026-88371
[1] https://github.com/mchehab/zbar/issues/336

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore