Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🔵 #Wire, Protobuf Decoder Positive Length Overflow, #CVE-2026-45799 / #CVE-2026-61695 -DC-Sep2026-2426 https://dailycve.com/wire-protobuf-decoder-positive-length-overflow-cve-2026-45799-cve-2026-61695-dc-sep2026-2426/
Post summary
The post announces two CVEs affecting Wire's protobuf decoder, describing the vulnerability as a positive length overflow, and provides a link to further details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | squareup | wire | - | - | - |
| App | squareup | wire | 7.0.0 | - | - |
| App | squareup | wire | 7.0.0 | - | - |