CVE-2026-110596: quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search
quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern() in lib/identify.c that allows attackers to hang quircend() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode() iterations that exhaust CPU in applications decoding attacker-supplied QR images.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use quirc through 1.2 to decode QR images supplied by untrusted users are exposed. The impact is CPU exhaustion while processing a crafted image.
What must an attacker provide to trigger the denial of service?
An attacker must cause the application to decode a crafted QR image containing three finder patterns arranged to create a near-degenerate perspective transform. Exploitation requires user interaction, consistent with the supplied CVSS vector.
Which operation is affected during QR decoding?
The excessive iteration occurs in find_alignment_pattern() in lib/identify.c. A crafted image can cause quirc_end() to spend billions of iterations in region_code() and hang.