p PatchFirst

CVE-2026-110596

CVE-2026-110596 · quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search

This page contains facts from public vulnerability sources. Check the original advisory before updating.

quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.

CVSS 6.8 · Medium · EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • quirc

    Versions
    • ≥ 0, ≤ 1.2: Affected (custom)

    No fix published

  • quirc Debian:14

    Versions
    • 1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • quirc Ubuntu:26.10

    Versions
    • 1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →