Quirc
Monthly
Denial of service in the quirc QR-code decoding library (versions through 1.2) allows an attacker who supplies a crafted QR image to hang the decoder in quirc_end(), pinning a CPU core for an effectively unbounded time. The excessive-iteration flaw lives in find_alignment_pattern() in lib/identify.c: a slide of three finder patterns can produce a near-degenerate perspective transform whose near-zero denominator inflates size_estimate, driving the alignment-pattern spiral through billions of region_code() iterations on a tiny image. Impact is availability-only (CVSS 4.0 VC:N/VI:N/VA:H; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): no authentication is required, but exploitation needs the host application to actually decode attacker-controlled image data (UI:P / UI:R passive interaction), so exposure is limited to services or apps that automatically run quirc over untrusted uploads; no public exploit was identified at time of analysis, though a public technical writeup of the loop condition exists and an upstream fix has been published as PR #159.
Denial of service in the quirc QR-code decoding library (versions through 1.2) allows an attacker who supplies a crafted QR image to hang the decoder in quirc_end(), pinning a CPU core for an effectively unbounded time. The excessive-iteration flaw lives in find_alignment_pattern() in lib/identify.c: a slide of three finder patterns can produce a near-degenerate perspective transform whose near-zero denominator inflates size_estimate, driving the alignment-pattern spiral through billions of region_code() iterations on a tiny image. Impact is availability-only (CVSS 4.0 VC:N/VI:N/VA:H; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): no authentication is required, but exploitation needs the host application to actually decode attacker-controlled image data (UI:P / UI:R passive interaction), so exposure is limited to services or apps that automatically run quirc over untrusted uploads; no public exploit was identified at time of analysis, though a public technical writeup of the loop condition exists and an upstream fix has been published as PR #159.