5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31961

CVE-2026-31961: Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing

Impact

Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing.

When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files.

Patches

Fixed in Quill v0.7.1

Workarounds

None

Credit

Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability

Resources

Inside code signing: hashes (Apple documentation)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31961

CVE-2026-31961:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/anchore/quill	go	< 0.7.1	0.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by unbounded memory allocation in the Mach-O binary parsing logic of the Quill library. The root cause is the failure to validate several size and count fields (DataSize, DataOffset, Count, Length) read from the LC_CODE_SIGNATURE load command and its nested code signing structures. An attacker can craft a minimal Mach-O file with extremely large values in these fields. When Quill processes this file, it uses these unvalidated values to allocate memory buffers. This leads to excessive memory allocation, causing a denial of service by crashing the host process.

The patch addresses this by introducing several validation checks. It defines maximum allowable values for the superblob size, blob count, and individual blob lengths. It also adds a new function, validateDataRange, to ensure that the data ranges specified in the binary (offset and size) are actually within the bounds of the file. These checks are applied in all functions that parse the code signing data, including CDBytes, CMSBlobBytes, HashPages, and RemoveSigningContent, effectively mitigating the vulnerability.

Vulnerable functions

quill/macho.(*File).CDBytes

quill/macho/file.go

The function allocates memory based on multiple fields read from a Mach-O file (`cmd.DataSize`, `csBlob.Count`, `cdBlobHeader.Length`) without proper validation. An attacker can provide a crafted file with large values in these fields to cause excessive memory allocation, leading to a denial of service.

quill/macho.(*File).CMSBlobBytes

quill/macho/file.go

The function, before being refactored, allocated memory based on `cmd.DataSize` and `blobHeader.Length` fields read from a Mach-O file without proper validation. An attacker could provide a crafted file with large values in these fields to cause excessive memory allocation, leading to a denial of service.

quill/macho.(*File).HashPages

quill/macho/file.go

The function uses the `DataOffset` field from the `LC_CODE_SIGNATURE` load command to create a section reader. The contents of this reader were then read into memory using `io.ReadAll`. Before the patch, this offset was not validated against the file size, allowing an attacker to specify a large offset, causing `io.ReadAll` to allocate a large amount of memory, leading to a denial of service.

quill/macho.(*File).RemoveSigningContent

quill/macho/file.go

The function removes the code signing content by creating a buffer of zeros and writing it over the signature data. The size of this buffer was determined by the unvalidated `DataSize` field from the `LC_CODE_SIGNATURE` load command. An attacker could provide a malicious `DataSize` value, causing the function to attempt a large memory allocation for the buffer, leading to a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.