Read the docs
TI-2026-44167 Aliases CVE-2026-61695GHSA-86wm-r4c5-2rc9

Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Priority HIGH 72CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-129 and the CVSS impact.

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0069 53rd percentileScored 2026-11-07
Fix Fixed wire (square): 6.4.1, 7.0.0-alpha04github.com/square/wire (SwiftURL): 6.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
squarewirebefore 6.4.1; 7.0.0-alpha01 to before 7.0.0-alpha046.4.1, 7.0.0-alpha04Patch availableCNA
—github.com/square/wire (SwiftURL)before 6.4.16.4.1Patch availableGHSA-86wm-r4c5-2rc9
  • wire Vendorsquare Affected before 6.4.1; 7.0.0-alpha01 to before 7.0.0-alpha04 Fixed in 6.4.1, 7.0.0-alpha04 Patch available CNA
  • github.com/square/wire (SwiftURL) Vendor— Affected before 6.4.1 Fixed in 6.4.1 Patch available GHSA-86wm-r4c5-2rc9

Remediation

  • Fix · CNA wire (square) Fixed in 6.4.1, 7.0.0-alpha04
  • Fix · GHSA-86wm-r4c5-2rc9 github.com/square/wire (SwiftURL) Fixed in 6.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61695
  2. 2026-10-03 Alias added: GHSA-86wm-r4c5-2rc9
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 7

  • TI-2026-45064 Integer overflow in square wire CVSS 3.1HIGH 7.5
  • TI-2026-71027 Insecure YAML deserialization in Square Squash symbolication API CVSS 4.0CRITICAL 9.2
  • TI-2024-38317 Uncontrolled recursion in square Wire CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences