Square Wire CVE-2026-63126

Exploitation requires that the target application uses Square Wire (< 6.4.5, or the 7.0.0 pre-release line before 7.0.0-alpha04) to decode protobuf bytes that an attacker can influence - specifically via Kotlin ProtoAdapter.decode(ByteArray/ByteString) (ByteArrayProtoReader32.internalNextLengthDelimited), or the Swift ProtoDecoder.decodeSizeDelimited / ProtoReader / ReadBuffer.readVarint paths. The malformed input is a length-delimited field whose positive oversized length varint wraps the cursor to a negative limit. No authentication or user interaction is needed (PR:N/UI:N). The practical limiting factor is reachability: the attacker must be able to deliver crafted protobuf bytes to a decode call, so risk is highest for network services parsing untrusted messages and lower for apps that only decode trusted/local data. Impact is confined to availability (crash/allocation exhaustion); no data exposure or code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a low-complexity, unauthenticated, remote issue with availability-only impact and no confidentiality, integrity, or code-execution consequences (explicitly stated by the vendor). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three exploitation-likelihood signals are absent or negative. The AV:N rating is conditional on how Wire is embedded: it is a protobuf/gRPC parsing library, so network reachability depends on the host application actually decoding attacker-supplied protobuf bytes over the wire (a common but not universal deployment). The realistic priority is moderate-to-low: this is a genuine DoS in a widely-used library, easy to trigger where reachable, but bounded to availability with no evidence of active exploitation. Treat it as a dependency-hygiene patch rather than an emergency; teams parsing untrusted protobuf from network peers should prioritize higher. CWE-190 (integer overflow) matches the described pos+length wraparound to a negative limit.

An attacker sends a crafted protobuf message with a positive oversized length-delimited field to a service or app that decodes it via Wire (e.g. ProtoAdapter.decode in Kotlin or ProtoDecoder.decodeSizeDelimited in Swift). The oversized length wraps the cursor to a negative limit, escaping the negative-length check, causing an unchecked exception/trap, out-of-bounds behavior, or an enormous allocation that crashes or exhausts the process. No public weaponized exploit is identified, though the fix PR ships test vectors (e.g. UInt64.max size varint) that demonstrate the malformed inputs.