quirc EUVD-2026-101224

Exploitation requires the target application to pass an attacker-controlled QR image through quirc's decode path (quirc_end() calling find_alignment_pattern()); the malicious image must specifically arrange three finder patterns that produce a near-degenerate (near-zero denominator) perspective transform, inflating size_estimate so the spiral search runs for billions of iterations. The CVSS vector (UI:P) indicates passive user interaction - the crafted image must be ingested/decoded rather than exploitation occurring autonomously - which limits opportunistic mass exploitation unless the host app automatically decodes untrusted uploaded images. There is no authentication requirement (PR:N), and only versions of quirc through 1.2 (prior to the PR #159 fix) are affected; applications not invoking quirc on untrusted images are not exposed.

This is a denial-of-service (availability-only) vulnerability, confirmed by both the CWE-834 (Uncontrolled Iteration/Loop) classification and the CVSS 4.0 vector (VC:N/VI:N/VA:H), which shows no confidentiality or integrity impact. The vendor-supplied CVSS 4.0 score of 6.8 (Medium) is driven by AV:L (local), AC:L, PR:N, UI:P (passive user interaction), and high availability impact. No EPSS score, CISA KEV listing, or confirmed working exploit was provided in the input, so there is no evidence of active exploitation; the risk is real but bounded. The practical severity depends heavily on context: the CVSS marks the vector as Local with required user interaction, implying the crafted QR image must be fed to the decoder (e.g. a user opens or scans an image), yet the description's phrase 'applications decoding attacker-supplied QR images' means that any service which auto-ingests remote/untrusted images (upload endpoints, scanners, pipelines) effectively faces a remotely-triggerable CPU-exhaustion condition - a mismatch worth verifying against each deployment. Because quirc is an embedded library rather than a standalone service, blast radius is determined by the host application. Overall this is a legitimate hardening priority for anyone decoding untrusted QR images, but it is a resource-exhaustion DoS, not a code-execution or data-exposure flaw, so it should be prioritized below RCE/info-leak issues of comparable score.

An attacker crafts a QR-code image whose three finder patterns yield a near-degenerate perspective transform, then delivers it to an application that uses quirc to decode user-supplied images (e.g. an image-upload or document-scanning endpoint). When the application calls quirc_end(), find_alignment_pattern() spins for hundreds of millions to billions of region_code() iterations, pinning a CPU core and hanging the decode thread. A detailed technical write-up describing the spiral-search infinite loop is publicly available (hackmd/VulnCheck advisory), though no packaged exploit code was indicated in the provided data.