CVE-2026-110596
Received
Received - Intake
quirc Endless Loop in QR Code Decoding
Vulnerability report for CVE-2026-110596, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-14
Last updated on: 2026-10-14
Assigner: VulnCheck
Description
Description
quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlbeer | quirc | 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-834 | The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. |
