CVE-2026-61695

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

• CWE-129

• https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c
• https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e
• https://github.com/square/wire/pull/3616
• https://github.com/square/wire/releases/tag/6.4.1
• https://github.com/square/wire/releases/tag/7.0.0-alpha04
• https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61686SolidInvoice is an open-source invoicing platform. Prior to …7.5
• CVE-2026-61687Hatchet is a platform for orchestrating background tasks, AI…7.1
• CVE-2026-61688SolidInvoice is an open-source invoicing platform. Prior to …6.5
• CVE-2026-6169The affiliate-toolkit plugin for WordPress is vulnerable to …7.2
• CVE-2026-61690Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipA…6.5
• CVE-2026-61692Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61696Forem is open source software for building communities. In v…6.3
• CVE-2026-61699nebula-mesh is a self-hosted control plane for Slack Nebula …8.1
• CVE-2026-61700MariaDB Connector/J is used to connect applications develope…3.7
• CVE-2026-61701Laravel MagicLink creates links for authentication without a…8.8
• CVE-2026-61704Link Preview JS extracts web links information. Prior to 4.0…7.5
• CVE-2026-61709OpenFGA is an authorization and permission engine built for …5.3