quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end(...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:26.10 quirc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

report ubuntu.com
report cve.org
report github.com
report github.com
report github.com
report hackmd.io
report vulncheck.com