CVE-2026-31961: Anchore Quill unbounded memory allocation in Mach-O parsing

Executive brief

Anchore Quill, a tool used for signing and verifying macOS binaries, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted, small file that causes the software to attempt to allocate massive amounts of system memory. This can crash the signing service or CI/CD pipeline, disrupting software development and release workflows.

Technical details

Quill before version 0.7.1 contains an unbounded memory allocation vulnerability (CWE-770) within its Mach-O binary parsing logic. The root cause is a failure to validate size and count fields—specifically DataSize, DataOffset, and Size from the LC_CODE_SIGNATURE load command, as well as Count and Length fields in SuperBlob and BlobIndex structures. An attacker can craft a small (~4KB) Mach-O binary with extremely large values in these fields. When processed by the Quill CLI or Go library, the application attempts to allocate excessive memory buffers, leading to memory exhaustion and a crash of the host process. The vulnerability is fixed in version 0.7.1.

Affected products

• anchore quill < 0.7.1

Timeline

• 2026-03-10: patched: Fixed in version 0.7.1
• 2026-03-11: advisory: GitHub Advisory published

References

• https://api.github.com/users/opera-aklajn
• https://github.com/opera-aklajn
• https://api.github.com/users/opera-aklajn/gists%7B/gist_id%7D
• https://api.github.com/users/opera-aklajn/repos
• https://avatars.githubusercontent.com/u/225386233?v=4
• https://api.github.com/users/opera-aklajn/events%7B/privacy%7D