PT-2026-53645 · Pypi · Zbar

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A heap-based buffer overflow exists in the qr reader match centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

Correção

Identificadores relacionados

PYSEC-2026-576

Produtos afetados

Zbar

Referências · 9

• https://github.com/mchehab/zbar · Nota
• https://osv.dev/vulnerability/PYSEC-2026-576 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP · Aviso do Fabricante
• https://hackmd.io/@cspl/B1ZkFZv23 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-40889 · Nota de Segurança
• https://github.com/advisories/GHSA-mhp6-jvpx-2p4m · Nota
• https://pypi.org/project/zbar · Nota
• https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html · Nota