iOS Client for Wire Messaging Application Vulnerability in Wire

CVE-2026-35049

What is CVE-2026-35049?

The Wire iOS client, used for secure messaging, is susceptible to a vulnerability that causes the application to crash upon receiving a specially crafted Proteus external message. This specific message contains an encrypted payload that is less than 16 bytes, leading to an automated crash sequence immediately after message receipt, without any user action needed. The persistence of this harmful message in the conversation results in a continuous crash loop whenever the application is relaunched, effectively locking users out until they manually clear the local application state. The issue has been addressed in version 4.16.0, which incorporates a necessary length check to prevent such crashes. Users are urged to update to the latest version to ensure their application remains secure.

References