The quirc library ≤1.2 contains a flaw in find_alignment_pattern() where a malformed QR code can cause quirc_end() to spin through a spiral search loop. This leads to an enormous number of region_code() iterations, exhausting CPU cycles and causing the decoding application to hang. The vulnerability falls under CWE‑834: Uncontrolled Resource Consumption. The effect is that any process using quirc to decode attacker‑supplied QR images becomes vulnerable to a denial‑of‑service attack.

The affected product is the quirc 1.2 library distributed by dlbeer. Projects or services that link against this version when decoding QR codes can be compromised. The issue was reported in the source repository and does not affect later versions. If your application includes quirc 1.2 or earlier, it is exposed.

The risk is primarily that any service with unbounded image decoding using this library may become unavailable when an attacker provides a specially crafted QR code. Because checks for perspective distortion are not performed, the exploit can be considered reliable if the decoding function is called. The EPSS score of 0.00172 indicates a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Administrators should treat it as a medium‑to‑high risk until a patch is applied.