Read the docs
TI-2026-27252 Aliases CVE-2026-35049

wire-ios has Persistent Remote DoS via Integer Underflow

Priority LOW 28CWE-191Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon receiving a crafted malicious Proteus external message with an encrypted payload that is shorter than 16 bytes, the Wire iOS client crashes. The crash is triggered automatically after message receival with no user interaction. Since the malicious message persists in the conversation, the app enters a crash loop on relaunch and cannot be reopened until the local state is wiped. This issue has been fixed with version 4.16.0 which introduces the missing length check and is available via the App Store. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed wire-ios (wireapp): 4.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wireappwire-iosbefore 4.16.04.16.0Patch availableCNA
  • wire-ios Vendorwireapp Affected before 4.16.0 Fixed in 4.16.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wire:wire:*:*:*:*:*:*:*:*——wireapp
  • cpe:2.3:a:wire:wire:*:*:*:*:*:*:*:* Versions — — ·wireapp

Remediation

  • Fix · CNA wire-ios (wireapp) Fixed in 4.16.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35049

References

Other 1

  • TI-2021-17958 DoS vulnerabiliity in wire-server json parser CVSS 3.1HIGH 7.5
  • TI-2022-21436 Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all… CVSS 3.1MEDIUM 4.7
  • TI-2021-18032 Use of Externally-Controlled Format String in wire-avs CVSS 3.1CRITICAL 9.8
  • TI-2022-13166 Improper authentication in wireapp wire-server CVSS 3.1CRITICAL 9.8
  • TI-2020-16922 Wire before 2020-10-16 allows remote attackers to cause a denial of service (application… CVSS 3.1CRITICAL 9.8
  • TI-2022-07663 Improper Verification of Cryptographic Signature in wire-server CVSS 3.1CRITICAL 9.1
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences