Wire before 2020-10-16 allows remote attackers to cause a denial of service (application…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-134 and the CVSS impact.
Summary
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wire:wire:*:*:*:*:*:linux:*:* | before 3.21.2936 | Vulnerable | wireapp |
| cpe:2.3:a:wire:wire:*:*:*:*:*:windows:*:* | before 3.21.3932 | Vulnerable | wireapp |
| cpe:2.3:a:wire:wire:*:*:*:*:*:macos:*:* | before 3.21.3959 | Vulnerable | wireapp |
| cpe:2.3:a:wire:wire_-_audio\,_video\,_and_signaling:*:*:*:*:*:*:*:* | 5.3 to before 6.4 | Vulnerable | wireapp |
| cpe:2.3:a:wire:wire_secure_messenger:*:*:*:*:*:android:*:* | before 3.49.918 | Vulnerable | wireapp |
| cpe:2.3:a:wire:wire_secure_messenger:*:*:*:*:*:iphone_os:*:* | before 3.61 | Vulnerable | wireapp |
- cpe:2.3:a:wire:wire:*:*:*:*:*:linux:*:* Versions before 3.21.2936 Vulnerable ·wireapp
- cpe:2.3:a:wire:wire:*:*:*:*:*:windows:*:* Versions before 3.21.3932 Vulnerable ·wireapp
- cpe:2.3:a:wire:wire:*:*:*:*:*:macos:*:* Versions before 3.21.3959 Vulnerable ·wireapp
- cpe:2.3:a:wire:wire_-_audio\,_video\,_and_signaling:*:*:*:*:*:*:*:* Versions 5.3 to before 6.4 Vulnerable ·wireapp
- cpe:2.3:a:wire:wire_secure_messenger:*:*:*:*:*:android:*:* Versions before 3.49.918 Vulnerable ·wireapp
- cpe:2.3:a:wire:wire_secure_messenger:*:*:*:*:*:iphone_os:*:* Versions before 3.61 Vulnerable ·wireapp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27853
- 2026-10-03 Alias added: GHSA-72jw-4jcq-xh9j
References
More wireapp Wire vulnerabilities
- TI-2022-21436 Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all… CVSS 3.1MEDIUM 4.7
- TI-2021-17935 Account takeover when having only access to a user's short lived token CVSS 3.1CRITICAL 9.8
- TI-2021-12333 Verified groups not reliable CVSS 3.1HIGH 8.8
- TI-2020-12030 Insecure use of shell.openExternal in Wire CVSS 3.1HIGH 8.0
- TI-2018-06447 The Wire application before 2018-03-07 for Android allows attackers to write to pathnames… CVSS 3.0HIGH 7.5
- TI-2022-07678 DoS vulnerability: Malformed Resource Identifiers CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-27853 · CVE Program
- CVE-2020-27853 · NVD
- FIRST EPSS
- GHSA-72jw-4jcq-xh9j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences