CVE-2026-110596 in quirc
Summary
by MITRE • 10/14/2026
quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as CVE-2019-13658 resides within the quirc library, specifically affecting versions up to 1.2. This software is widely utilized for its efficient QR code detection and decoding capabilities in various embedded systems and applications. The core issue lies in the find_alignment_pattern function located in lib/identify.c. An excessive-iteration vulnerability allows an attacker to cause a denial of service by hanging the quirc_end() process when processing maliciously crafted images. This flaw exploits the algorithmic logic used for locating alignment patterns within QR codes, which are essential for correcting perspective distortions and ensuring accurate data extraction from scanned symbols.
The technical mechanism behind this exploit involves manipulating the geometric arrangement of finder patterns in a submitted image. By constructing an image with three specific finder patterns that create a near-degenerate perspective transform, the attacker forces the library into an infinite or excessively long loop within the region_code function. This mathematical anomaly prevents the algorithm from converging on valid alignment points efficiently. Instead of terminating gracefully after determining no valid QR code exists, the processor continues iterating through billions of potential regions. This behavior results in significant CPU exhaustion, effectively freezing any application relying on quirc for image processing until external intervention or timeout occurs.
From an operational perspective, this vulnerability poses a severe risk to services that accept user-supplied images containing QR codes. Applications such as mobile payment processors, inventory management systems, and web-based scanning tools are particularly susceptible if they do not implement strict timeouts or resource limits on the decoding process. The impact is primarily a denial of service rather than data leakage or remote code execution. However, in high-throughput environments where many images are processed concurrently, this vulnerability can lead to system-wide performance degradation or complete unavailability of scanning services. Attackers can leverage this by hosting malicious web pages or sending crafted attachments that trigger the flaw upon automated processing.
This issue is categorized under CWE-835, which describes loops with excessive iterations leading to resource exhaustion. It also aligns with ATT&CK technique T1496, representing Resource Hijacking where an attacker consumes computational resources to disrupt service availability. Mitigation strategies should focus on implementing robust input validation and enforcing strict execution time limits for the decoding functions. Developers integrating quirc into their applications must ensure that calls to quirc_end() are wrapped with timeout mechanisms or signal handlers that can interrupt long-running processes. Additionally, upgrading to patched versions of the library where this logic has been corrected is essential for long-term security posture.