CVE-2026-31961

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31961", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:40:10.483Z", "datePublished": "2026-03-11T19:32:28.920Z", "dateUpdated": "2026-03-11T19:58:31.965Z"}, "containers": {"cna": {"title": "Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94"}], "affected": [{"vendor": "anchore", "product": "quill", "versions": [{"version": "< 0.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:32:28.920Z"}, "descriptions": [{"lang": "en", "value": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing. When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files. This vulnerability is fixed in 0.7.1."}], "source": {"advisory": "GHSA-xj69-m9qq-8m94", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T19:58:02.672628Z", "id": "CVE-2026-31961", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T19:58:31.965Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31961", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T19:58:02.672628Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T19:58:23.101Z"}}], "cna": {"title": "Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsing", "source": {"advisory": "GHSA-xj69-m9qq-8m94", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "anchore", "product": "quill", "versions": [{"status": "affected", "version": "< 0.7.1"}]}], "references": [{"url": "https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94", "name": "https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing. When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files. This vulnerability is fixed in 0.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T19:32:28.920Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31961", "state": "PUBLISHED", "dateUpdated": "2026-03-11T19:58:31.965Z", "dateReserved": "2026-03-10T15:40:10.483Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T19:32:28.920Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "quill", "vendor": "anchore", "versions": [{"status": "affected", "version": "< 0.7.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:anchore:quill:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1E31EEF-FC47-43F9-8797-60E94FB1C0E5", "versionEndExcluding": "0.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing. When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files. This vulnerability is fixed in 0.7.1."}, {"lang": "es", "value": "Quill proporciona firma binaria de mac y notarizaci\u00f3n simples desde cualquier plataforma. Quill antes de la versi\u00f3n v0.7.1 contiene una vulnerabilidad de asignaci\u00f3n de memoria ilimitada al analizar binarios Mach-O. La explotaci\u00f3n requiere que Quill procese un binario Mach-O proporcionado por un atacante, lo cual es m\u00e1s probable en entornos como pipelines de CI/CD, servicios de firma compartidos o cualquier flujo de trabajo donde se acepten binarios enviados externamente para la firma. Al analizar un binario Mach-O, Quill lee varios campos de tama\u00f1o y recuento del comando de carga LC_CODE_SIGNATURE y estructuras de firma de c\u00f3digo incrustadas (SuperBlob, BlobIndex) y los usa para asignar b\u00faferes de memoria sin validar que los valores sean razonables o consistentes con el tama\u00f1o real del archivo. Los campos afectados incluyen DataSize, DataOffset y Size del comando de carga, Count del encabezado SuperBlob y Length de los encabezados de blobs individuales. Un atacante puede crear un binario Mach-O malicioso m\u00ednimo (~4KB) con valores extremadamente grandes en estos campos, lo que hace que Quill intente asignar memoria excesiva. Esto lleva al agotamiento de la memoria y a la denegaci\u00f3n de servicio, lo que podr\u00eda bloquear el proceso anfitri\u00f3n. Tanto la CLI de Quill como la biblioteca de Go se ven afectadas cuando se usan para analizar archivos Mach-O no confiables. Esta vulnerabilidad se corrige en 0.7.1."}], "id": "CVE-2026-31961", "lastModified": "2026-06-17T10:34:50.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31961", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T19:58:02.672628Z", "version": "2.0.3"}}]}, "published": "2026-03-11T20:16:17.103", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.7.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "quill", "source": "cna", "vendor": "anchore"}, "product": "quill", "vendor": "anchore"}], "analysis": {"en": {"generated_at": "2026-03-17T16:27:38.505195+00:00", "value": {"mitigation_remediation": ["Upgrade Quill to version 0.7.1 or later; the patch removes the unbounded allocation logic.", "If an immediate upgrade is not possible, restrict Quill to only process trusted binaries or apply strict input validation before passing files to Quill.", "Run Quill in a sandboxed or containerized environment with enforced memory limits to contain potential exhaustion impact.", "Monitor for out\u2011of\u2011memory or crash events in the CI/CD pipeline and enable automatic recovery or alerting."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service (memory exhaustion)"}, "threat_synthesis": {"affected_systems": "The affected product is Quill from anchore. All releases prior to v0.7.1, including both the command\u2011line interface and the Go library, are vulnerable. Any environment that allows Quill to parse externally supplied Mach\u2011O binaries\u2014such as CI/CD pipelines, shared signing services, or other automated build workflows\u2014is at risk.", "description_and_impact": "Quill, a macOS binary signing utility developed by anchore, contains an unbounded memory allocation flaw (CWE-770) when parsing Mach\u2011O binaries before version 0.7.1. The vulnerability stems from Quill reading size and count fields\u2014such as DataSize, DataOffset, Size, Count, and Length\u2014from the LC_CODE_SIGNATURE load command and embedded signing structures without validating them against the actual file size. An attacker can craft a minimal (~4\u202fKB) Mach\u2011O file with exaggerated values for these fields, causing Quill to attempt to allocate excessive amounts of memory. This results in memory exhaustion and can bring the Quill process to a halt, effectively denying service to any signing workflow that relies on the tool.", "risk_and_exploitability": "The CVSS base score of 5.5 indicates medium severity. The EPSS score is below 1%, suggesting a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker supplies a specially crafted Mach\u2011O file to a vulnerable instance of Quill; this is feasible in contexts where binaries are uploaded for signing. The effect is restricted to denial of service through memory exhaustion; there is no evidence of arbitrary code execution or privilege escalation."}}}}, "created": "2026-03-12T09:56:39.289450+00:00", "updated": "2026-03-20T15:29:13.631140+00:00", "vendors": ["anchore", "anchore$PRODUCT$quill"]}