PT-2026-53645 · Pypi · Zbar

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A heap-based buffer overflow exists in the qr reader match centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.

Fix

Related Identifiers

PYSEC-2026-576

Affected Products

Zbar

References · 9

• https://osv.dev/vulnerability/PYSEC-2026-576 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DC7V5YCLCPB36J2KY6WLZCABFLBRB665 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25LZZQJGGZRPLKTRNRNOTAFQJIPS7WRP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40889 · Security Note
• https://github.com/mchehab/zbar · Note
• https://hackmd.io/@cspl/B1ZkFZv23 · Note
• https://github.com/advisories/GHSA-mhp6-jvpx-2p4m · Note
• https://pypi.org/project/zbar · Note
• https://lists.debian.org/debian-lts-announce/2023/12/msg00001.html · Note