CVE-2026-110596

Deferred Deferred - Pending Action

quirc Endless Loop in QR Code Decoding

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110596

EUVD

EUVD-2026-101224

Affected Vendors & Products

Vendor	Product	Version / Range
dlbeer	quirc	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-834	The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

Executive Summary

CVE-2026-110596 is a denial-of-service vulnerability in the quirc QR code decoding library (v1.2). It occurs in the find_alignment_pattern() function where a crafted QR image with three finder patterns creates a near-degenerate perspective transform. This causes the spiral search loop to run billions of times due to an unbounded size estimate, freezing the device by exhausting CPU resources.

Detection Guidance

To detect this vulnerability, monitor CPU usage spikes when processing QR images. Check for processes running quirc library functions like find_alignment_pattern() or quirc_end() consuming excessive CPU. Use system monitoring tools like top, htop, or ps to identify abnormal CPU usage during QR code decoding operations.

Impact Analysis

This vulnerability can cause applications using quirc to hang or freeze when processing malicious QR images. On devices like microcontrollers, it may lead to system unresponsiveness. For example, a 111x111 image can pin a CPU core for ~100 seconds. It does not allow code execution or data theft but disrupts normal operations.

Compliance Impact

This vulnerability primarily causes denial-of-service by consuming excessive CPU resources, which may impact system availability. It does not directly affect data confidentiality or integrity, so its impact on GDPR or HIPAA compliance is likely limited to potential availability issues in systems processing QR codes.

Mitigation Strategies

Update quirc to the latest patched version. If updating is not possible, implement input validation to reject malformed QR images. Add bounds checks in alignment pattern search functions to prevent excessive iterations. Limit image processing timeouts for QR decoding operations.

Hi! I’m here to help you understand CVE-2026-110596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70