CVE-2026-110596

MEDIUM 5.5

quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.

CWE	CWE-834
Vendor	dlbeer
Product	quirc
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for dlbeer quirc

Be the first to know when new medium vulnerabilities affecting dlbeer quirc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

dlbeer / quirc

0 ≤ 1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dlbeer/quirc/pull/159 github.com: https://github.com/dlbeer/quirc/issues/162 hackmd.io: https://hackmd.io/@haind-pwn/quirc-alignment-pattern-infinite-loop-dos github.com: https://github.com/dlbeer/quirc/blob/542848dd6b9b0eaa9587bbf25b9bc67bd8a71fca/lib/identify.c#L578-L636 vulncheck.com: https://www.vulncheck.com/advisories/quirc-through-1.2-denial-of-service-via-find-alignment-pattern-spiral-search

Credits

AlexandrKhromov2005 JohannYellow HaiND from the Post and Telecommunication Institute of Technology