CVE-2023-40890

CVE-2023-40890 is a critical stack-based buffer overflow vulnerability in the lookup_sequence function of ZBar 0.23.90, affecting the zbar_project zbar product. This flaw allows attackers to achieve information disclosure and/or arbitrary code execution by presenting specially crafted QR codes, either digitally or physically. With a CVSS score of 9.8 (CRITICAL) and a FAUCET Risk Score of 92/100, it poses a significant threat due to its network-based attack vector and low attack complexity, requiring no user interaction or privileges. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has garnered notable community discussion with 10 mentions, indicating awareness among security researchers.