ZBar versions through 0.23.95 contain an out-of-bounds read in the function _zbar_sq_decode() within sqcode.c. A crafted SQ code image with a skewed finder pattern near the image edge leads to unchecked sample coordinates, allowing the decoder to read heap memory beyond the image buffer. This can cause a program crash and leak arbitrary bytes into the output. The primary consequence is information disclosure rather than execution of code, but the exposed memory could contain sensitive data used by the host application.

The vulnerability affects the ZBar barcode decoder library distributed by mchehab, specifically all releases up to and including 0.23.95. Any application or service employing this library without a later, fixed version is susceptible.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers mitigate the issue by supplying a specially crafted image to the decoder, which may be done locally or remotely depending on how the application uses ZBar. Because the flaw is an out-of-bounds read, its exploitation requires the ability to provide image data to the library and a sufficient stack or heap layout that contains exploitable information. The risk is limited to information disclosure and potential denial of service via crashes if the attacker can inject the image. The lack of a known exploitation vector does not diminish the importance of applying a patch or mitigations promptly.