CVE-2026-31961 describes an unbounded memory allocation vulnerability in Quill versions prior to 0.7.1. When processing untrusted Mach-O binaries, Quill fails to validate size and count fields within load commands and code signing structures, leading to attempts at allocating excessive memory. This medium-severity vulnerability (CVSS 5.5) requires local access, typically in environments like CI/CD pipelines or shared signing services that process external binaries, and results in a high availability impact through memory exhaustion and potential denial of service. There is currently no evidence of active exploitation, public exploit code, or significant community discussion for this CVE. Organizations utilizing Quill should upgrade to version 0.7.1 to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.7.1CPE matchmatch criteria | cpe:2.3:a:anchore:quill:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.