ZBar CVE-2026-88371

Exploitation requires (1) an application that embeds ZBar at the vulnerable commit (2ea2ca58) with Code 128 decoding active, (2) the attacker's ability to supply a crafted Code 128 barcode for scanning (user interaction / passive input feed, UI:R), and (3) most significantly, a build compiled with trap-mode UndefinedBehaviorSanitizer (UBSan), since the SIGILL abort only triggers in that configuration. These are strong limiting factors: it is local (AV:L), not network-reachable, needs the victim to process attacker-supplied input, and the deterministic crash depends on a non-default sanitizer build typically used only in development, testing, or fuzzing rather than production.

This is a genuinely low-priority issue despite a moderate CVSS 5.5. The provided vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly captures a local, user-interaction-dependent denial of service with no confidentiality or integrity impact. All signals point the same direction: EPSS is very low (0.15%, 3rd percentile), the CVE is NOT on CISA KEV, and no exploit is flagged. Critically, the description itself caps real-world impact - the SIGILL crash manifests specifically in 'trap-mode UBSan builds,' which are development/testing/fuzzing configurations, NOT typical production deployments. In an ordinary optimized build the left-shift of a negative signed value is undefined behavior but will usually not deterministically crash the process, so the A:H rating overstates production availability impact; a real-world A:L is more defensible. The signals are consistent and non-conflicting, so there is no contradiction to flag - rather, the caveat is that the A:H impact is build-configuration-dependent, which the raw CVSS score does not surface.

An attacker crafts a malicious Code 128 barcode (image or data stream) and gets it scanned by an application that embeds ZBar built with UBSan trap mode enabled. When decode_e() returns -1 for the invalid edge pattern, decode6() left-shifts the negative value, triggering undefined behavior that aborts the process with SIGILL and denies service. The referenced GitHub issue (#336) likely contains reproduction details, but no packaged public exploit is indicated in the input data.