ZBar’s Code 128 decoder contains an undefined‑behavior flaw triggered by special input. A signed negative value returned by decode_e() is left‑shifted in decode6(), invoking undefined behavior that can cause a SIGILL fault in builds compiled with UBSan in trap mode. The only impact is a crash of the process using ZBar; no memory corruption or data disclosure occurs.

Any system that uses a ZBar library containing the buggy commit 2ea2ca58. Applications ranging from command‑line utilities to embedded barcode readers that parse Code 128 barcodes are at risk when they accept untrusted data.

The EPSS score of below 1 % indicates a very low likelihood of exploitation in the wild. The CVSS score of 5.5 indicates a medium severity. An attacker must provide malformed Code 128 data, which typically means the target receives user‑supplied barcodes. Successful exploitation results only in a denial‑of‑service via process termination, with no privilege escalation or information leakage. The vulnerability is marked as not listed in CISA KEV, reflecting its minimal exposure and limited impact on availability.