Read the docs
TI-2025-31761 Aliases CVE-2025-49846

wire-ios accidentally logs message contents

Priority LOW 18CWE-117Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have been logged to the iOS system logs in clear text. Wire application logs created and managed by the application itself were not affected, especially not the logs users can export and send to Wire support. The iOS logs can only be accessed if someone had (physical) access to the underlying unlocked device. The issue manifested itself by calling canOpenUrl() and passing an invalid URL object. When iOS then performs the check and fails, it logs the contents to the system log. This is not documented behaviour. Wire released an emergency fix with version 3.124.1. As a workaround, users can reset their iOS device to remove the offending logs. Since Wire cannot access or modify iOS system logs, there's no other workaround other than a reset.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed wire-ios (wireapp): 3.124.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wireappwire-ios3.111.1 to before 3.124.13.124.1Patch availableCNA
  • wire-ios Vendorwireapp Affected 3.111.1 to before 3.124.1 Fixed in 3.124.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wire:wire:*:*:*:*:*:*:*:*——wireapp
  • cpe:2.3:a:wire:wire:*:*:*:*:*:*:*:* Versions — — ·wireapp

Remediation

  • Fix · CNA wire-ios (wireapp) Fixed in 3.124.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49846

References

Other 3

  • TI-2021-17958 DoS vulnerabiliity in wire-server json parser CVSS 3.1HIGH 7.5
  • TI-2022-21436 Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all… CVSS 3.1MEDIUM 4.7
  • TI-2021-18032 Use of Externally-Controlled Format String in wire-avs CVSS 3.1CRITICAL 9.8
  • TI-2022-13166 Improper authentication in wireapp wire-server CVSS 3.1CRITICAL 9.8
  • TI-2020-16922 Wire before 2020-10-16 allows remote attackers to cause a denial of service (application… CVSS 3.1CRITICAL 9.8
  • TI-2022-07663 Improper Verification of Cryptographic Signature in wire-server CVSS 3.1CRITICAL 9.1
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences