CVE-2026-110596 — quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search
quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Att…
Published: 2026-10-14 · CVSS: 6.8 · CVSS 4.0
quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7