ZBar, the barcode reading library, contains a heap‑buffer‑overflow bug that writes one byte past a buffer when parsing Structured‑Append QR codes. The flaw occurs because a NUL separator byte inserted between decoded segments is not counted in the buffer size calculation, allowing an attacker to craft a QR image that corrupts heap memory and causes the application to crash. The vulnerability can therefore lead to a denial of service with no immediate confidentiality or integrity impact.

Any software that incorporates the ZBar library and processes QR codes—including mobile apps, desktop scanners, and embedded devices—may be affected. No specific product or version information is provided, so all builds of ZBar that may handle structured‑append QR codes are potentially vulnerable.

The CVSS score of 5.5 rates the flaw as moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, implying limited known exploitation. The likely attack vector requires an attacker to supply a malicious QR image, which when scanned by a user‑facing application, triggers heap corruption and results in a crash. The risk is primarily that the application becomes unavailable, but it does not facilitate code execution or data disclosure.