Vulnerability in Square Wire
CVE-2026-61695
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Square Wire — versions < 6.4.1, >= 7.0.0-alpha01, < 7.0.0-alpha04
Weakness classification (CWE)
References
- github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9
- github.com/square/wire/pull/3616
- github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c
- github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e
- github.com/square/wire/releases/tag/6.4.1
- github.com/square/wire/releases/tag/7.0.0-alpha04
Frequently asked questions
- What is CVE-2026-61695?
- CVE-2026-61695 is a high-severity vulnerability in Square Wire, classified under Improper Validation of Array Index. CVSS score: 7.5/10. Published 2026-09-23.
- How severe is CVE-2026-61695?
- High severity. CVSS v3 base score is 7.5 out of 10.