CVE-2026-61695 in Wire
Summary
by MITRE • 09/23/2026
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The Wire library serves as a critical infrastructure component for developers working with protocol buffers across multiple platforms including Android, Kotlin, Swift, and Java. It provides the necessary gRPC support and serialization logic to handle structured data efficiently. However, prior to versions 6.4.1 and 7.0.0-alpha04 in the Swift runtime environment, a significant security flaw was identified within the ProtoReader component. This vulnerability specifically affects the handling of unknown fields during the decoding process, where the library fails to properly validate input parameters before passing them deeper into the data processing pipeline.
The technical root cause lies in the implementation of the skipGroup method within the Swift runtime's ProtoReader class. When encountering a START_GROUP field that is marked as unknown, this function accepts a length parameter for LENGTH_DELIMITED fields without enforcing strict lower-bound validation. Specifically, it allows negative values to be passed through to the underlying ReadBuffer.readData function. While the readData function performs an upper-bound check to prevent buffer over-reads, it lacks a corresponding lower-bound check to reject negative counts. This oversight permits invalid data structures to propagate further into the system logic rather than being rejected at the parsing stage.
As the execution flow continues, the negative count value is forwarded directly to Foundation's Data initialization method bytes:count:. In Swift and Objective-C environments using Apple's Foundation framework, passing a negative length to this initializer triggers an unrecoverable process trap or assertion failure. This behavior results in an immediate crash of the application process rather than throwing a catchable ProtoDecoder.Error exception that could be handled gracefully by the calling code. The lack of proper error handling means that any untrusted protobuf data containing such malformed structures will cause the consuming application to terminate unexpectedly, leading to a denial of service condition for users relying on the software.
From an operational perspective, this vulnerability poses a severe risk to applications that decode protocol buffer messages from external or untrusted sources. An attacker can craft malicious protobuf payloads specifically designed with negative length fields within unknown group structures to trigger this crash mechanism remotely. The attack requires no authentication, user interaction, or prior knowledge of the target schema structure beyond the ability to inject data into the input stream. This makes it particularly dangerous in scenarios involving API endpoints, message queues, or any service that processes incoming protobuf streams without rigorous pre-validation against a strict schema definition.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write if interpreted broadly as memory safety issues, though the immediate effect is an application crash rather than arbitrary code execution due to modern OS protections. In terms of attack patterns, this represents a classic Denial of Service vector where malformed input leads to process termination, potentially mapping to ATT&CK techniques related to resource exhaustion or service disruption through invalid inputs. The severity is heightened by the fact that protocol buffers are often used in high-throughput environments where such crashes can lead to cascading failures across distributed systems.
The recommended mitigation strategy involves upgrading the Wire library to version 6.4.1 or later, which includes patches for this specific validation gap. For organizations unable to upgrade immediately, implementing strict schema enforcement at the network boundary is advised. This means validating incoming protobuf messages against a known-good schema before they reach the application logic that utilizes Wire's decoding capabilities. Additionally, developers should ensure that their error handling mechanisms are robust enough to catch and log unexpected exceptions during parsing operations, although this does not prevent the crash itself in Swift due to how Foundation handles invalid arguments. Regular security audits of third-party dependencies and continuous integration testing with fuzzed protobuf inputs can further reduce exposure to such vulnerabilities by detecting malformed data early in the development lifecycle.