Hi,

The following vulnerability was published for zbar.

CVE-2026-121942[0]:
| ZBar through 0.23.95 contains an out-of-bounds read vulnerability in
| _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read
| heap memory outside the image buffer via crafted SQ code images.
| Attackers can supply an image with a skewed SQ code finder pattern
| near the edge, producing unchecked sample coordinates that crash the
| decoder and leak bytes into output.

https://github.com/mchehab/zbar/issues/351


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-121942
https://www.cve.org/CVERecord?id=CVE-2026-121942

Please adjust the affected versions in the BTS as needed.

Hi,

Attached are DEP-3 patches for CVE-2026-121942 (out-of-bounds read in the SQ
code decoder).

Root cause: in _zbar_sq_decode() (zbar/sqcode.c) each per-pixel sample
position is computed by bilinear interpolation of the detected border-dot
centres. For a perspective-distorted code the interpolated coordinate can
land outside the image, and a negative intermediate additionally makes the
following float-to-unsigned conversion undefined. The resulting value was
used directly as an index into img->data, so a crafted grayscale (Y800)
image with a skewed SQ finder pattern near an edge reads past the image
buffer (CWE-125): the decoder can crash, and the out-of-bounds pixel values
feed into the decoded output, which can leak adjacent heap bytes. The path
is reachable from the public zbar_scan_image() with no special
configuration,
since SQ code is in the default build.

Fix: clamp both sample axes to [0, width-1] / [0, height-1] before each
image
access, and reject negative coordinates before the unsigned conversion. This
mirrors the QR_CLAMPI() guard that the sibling QR decoder has long used in
qr_img_get_bit(). In-range coordinates are returned unchanged, so legitimate
codes decode identically; only the previously out-of-bounds accesses change.

Attached:
CVE-2026-121942-sid-trixie.patch applies to 0.23.95-2 (sid) and
0.23.93-8 (trixie)
CVE-2026-121942-bookworm.patch applies to 0.23.92-7+deb12u1 (bookworm)

The two differ only in the surrounding indentation/declaration style of the
respective branch; the logical change is identical. I confirmed each applies
cleanly to the packaged source, and verified the clamp helper in isolation
(negative, oversized and boundary inputs all map to a valid in-range index,
and in-range values are returned unchanged). I did not rebuild each package
separately. The fix is also suitable for forwarding upstream.

Regards,
Sumit