High severity · published Sep 23, 2026
CVE-2026-61695
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
wire · square
< 6.4.1; >= 7.0.0-alpha01, < 7.0.0-alpha04 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61695
x_refsource_CONFIRM
https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9
x_refsource_MISC
https://github.com/square/wire/pull/3616
x_refsource_MISC
https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c
x_refsource_MISC
https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e
x_refsource_MISC
https://github.com/square/wire/releases/tag/6.4.1
x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0-alpha04
More from wire
7.5
CVE-2026-63126
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
7.5
CVE-2026-45799
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
5.8
CVE-2024-58103
Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt