Executive brief
Wire is a secure messaging application for iOS. A vulnerability in the app allows a malicious message to crash the client automatically upon receipt. Because the message remains in the user's chat history, the app will continue to crash every time it is opened, effectively locking the user out of their account and messages until the app is deleted and reinstalled.
Technical details
An integer underflow vulnerability exists in the Wire iOS client's handling of Proteus external messages. When the client receives an encrypted payload shorter than 16 bytes, it fails a length check, leading to an immediate application crash. The vulnerability is triggered automatically via the network without user interaction. Because the malicious message is persisted in the local database, the application enters a crash loop upon restart. The issue is rooted in improper input validation (CWE-20) and integer underflow (CWE-191) within the message processing logic. It has been patched in version 4.16.0.
Affected products
- Wire Wire iOS < 4.16.0
Timeline
- 2026-05-29: advisory: GitHub advisory published by Wire
- 2026-06-02: disclosed: CVE published to NVD
- 2026-06-02: patched: Fix released in version 4.16.0 via App Store