EUVD-2026-80937Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated low-complexity decode of attacker-supplied protobuf yields availability-only impact; AV:N assumes network-reachable decoding, C/I:N per vendor's DoS-only finding.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04.
AnalysisAI
Denial of service in Square Wire (the gRPC/protobuf runtime for Kotlin, Java, Swift, and Android) affects all releases before 6.4.5 and the 7.0.0 pre-release line before 7.0.0-alpha04, where attacker-supplied protobuf bytes containing an oversized length-delimited field can crash or exhaust memory in the decoder. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), with impact limited strictly to availability - the vendor states there is no confidentiality, integrity, or code-execution consequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses Square Wire (< 6.4.5, or the 7.0.0 pre-release line before 7.0.0-alpha04) to decode protobuf bytes that an attacker can influence - specifically via Kotlin ProtoAdapter.decode(ByteArray/ByteString) (ByteArrayProtoReader32.internalNextLengthDelimited), or the Swift ProtoDecoder.decodeSizeDelimited / ProtoReader / ReadBuffer.readVarint paths. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a low-complexity, unauthenticated, remote issue with availability-only impact and no confidentiality, integrity, or code-execution consequences (explicitly stated by the vendor). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Square Wire 6.4.5 (stable line) or 7.0.0-alpha04 (7.0.0 pre-release line), per the advisory at https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc and the releases at https://github.com/square/wire/releases/tag/6.4.5 and https://github.com/square/wire/releases/tag/7.0.0-alpha04; the code changes are in PR https://github.com/square/wire/pull/3635 (commits 082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f and 25ebcabb9ab7f12d1d77af75ecbc51726fddc015). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every service, backend, and mobile-adjacent component that decodes untrusted Wire protobuf payloads, prioritize those reachable from untrusted networks, and apply edge-level request-size and connection-rate limits. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbi
Restund is an open source NAT traversal server. Rated critical severity (CVSS 9.6), this vulnerability is remotely explo
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer
In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. Rated high severity (CVSS 8.0), this vuln
The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads direc
wire-webapp is the web version of Wire, an open-source messenger. Rated medium severity (CVSS 6.1), this vulnerability i
Wire-server is the backing server for the open source wire secure messaging application. Rated critical severity (CVSS 9
Wire is an open source secure messenger. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Rated high s
Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for
Wire is an encrypted communication and collaboration platform. Rated high severity (CVSS 8.1), this vulnerability is rem
wire-server provides back end services for Wire, an open source messenger. Rated high severity (CVSS 8.1), this vulnerab
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today