SB20261110275 - Improper Validation of Array Index in wire

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Validation of Array Index (CVE-ID: CVE-2026-61695)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by aborting a process decoding untrusted protobuf data with Wire's Swift runtime.

The vulnerability exists due to missing validation of negative lengths in ProtoReader.skipGroup() and ReadBuffer.readData(count:) when skipping unknown protobuf groups. A remote attacker can send the payload 9b060a80ffffff0f9c06, containing a LENGTH_DELIMITED field whose length decodes to -128, to trigger an unrecoverable trap in Foundation's Data(bytes:count:) and terminate the process.

Remediation

Install update from vendor's website.

References

• https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9
• https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e