Description
quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dlbeer | quirc | ≤ 1.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | quirc | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | quirc | No fix yet | — |
References
- https://github.com/dlbeer/quirc/pull/159 issue-tracking patch
- https://github.com/dlbeer/quirc/issues/162 issue-tracking
- https://hackmd.io/@haind-pwn/quirc-alignment-pattern-infinite-loop-dos third-party-advisory
- https://github.com/dlbeer/quirc/blob/542848dd6b9b0eaa9587bbf25b9bc67bd8a71fca/lib/identify.c#L578-L636 technical-description
- VulnCheck Advisory: quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search third-party-advisory