Protocol Buffer Vulnerability in Wire's Swift Runtime for Mobile Applications
CVE-2026-61695
7.5HIGH
What is CVE-2026-61695?
The Wire Swift runtime has a vulnerability that allows for the acceptance of a negative length for a LENGTH_DELIMITED field within an unknown START_GROUP field. This flaw occurs in ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) and can lead to unhandled exceptions when decoding untrusted protobuf bytes. It enables an attacker to crash any Swift process without the requirement for authentication or user interaction. The issue has been addressed in the updates released in versions 6.4.1 and 7.0.0-alpha04.
Affected Version(s)
wire < 6.4.1 < 6.4.1
wire >= 7.0.0-alpha01, < 7.0.0-alpha04 < 7.0.0-alpha01, 7.0.0-alpha04