← Vulnerability feed

Vulnerability record · CVE-2026-61695 · published 23 September 2026

CVE-2026-61695: Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java.

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

7.5 CVSS 3.1 High EPSS 0.58% · top 54.5% CWE-129 · CWE-129 Received
7.5CVSS 3.1 base score
0.58%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
6References
23 Sep 2026Last modified by NVD

Description

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

LinkTags
https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c
https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e
https://github.com/square/wire/pull/3616
https://github.com/square/wire/releases/tag/6.4.1
https://github.com/square/wire/releases/tag/7.0.0-alpha04
https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9

Track CVE-2026-61695 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-48503Apple WebKit bounds check flaw allows code execution via web contentApple fixed an insufficient bounds-checking issue in WebKit across Safari, iOS, iPadOS, macOS, tvOS and watchOS. Processing malicious web content can…KEVEPSS 3.2%analysed

Source: NIST National Vulnerability Database (record CVE-2026-61695), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.