Is CVE-2026-61695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61695 being exploited in the wild.

How severe is CVE-2026-61695?

High severity, with a CVSS score of 7.5, published 23 September 2026.

Which products and versions are affected?

github.com/square/wire (Swift) <= 6.4.0.

Is there a fix for CVE-2026-61695?

A patch was published on 2026-09-23: Wire 6.4.1 and 7.0.0-alpha04 contain PR #3616 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61695 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61695?

Check whether you run github.com/square/wire (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61695: Square Wire Swift runtime negative length in skipGroup() denial of service

Q: Is there a fix for CVE-2026-61695?

A patch was published on 2026-09-23: Wire 6.4.1 and 7.0.0-alpha04 contain PR #3616 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61695 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-61695?

Check whether you run github.com/square/wire (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61695 · Severity: high · CVSS 7.5 · Published 2026-09-23

Wire is a popular serialization library used by iOS, macOS, and server-side Swift applications to decode messages. A malformed protobuf payload with a negative length field can cause the Swift runtime to crash with an unrecoverable trap instead of throwing a catchable error, leaving applications unable to recover from the malicious input. This affects any application decoding untrusted protobuf data.

Vendors: Swift.

Quick answers

Is CVE-2026-61695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61695 being exploited in the wild.
How severe is CVE-2026-61695?: High severity, with a CVSS score of 7.5, published 23 September 2026.
Which products and versions are affected?: github.com/square/wire (Swift) <= 6.4.0.
Is there a fix for CVE-2026-61695?: A patch was published on 2026-09-23: Wire 6.4.1 and 7.0.0-alpha04 contain PR #3616 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61695 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61695?: Check whether you run github.com/square/wire (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing validation in ProtoReader.skipGroup() that failed to reject negative LENGTH_DELIMITED field lengths when skipping unknown protobuf groups. A crafted 10-byte payload with a varint-encoded negative Int32 length is passed directly to ReadBuffer.readData(count:), which only checks the upper bound. The negative count bypasses the bounds check and reaches Foundation's Data(bytes:count:), which traps with SIGTRAP instead of throwing a ProtoDecoder.Error. No authentication, user interaction, or schema knowledge is required; the attacker only needs to send an unknown START_GROUP field containing a LENGTH_DELIMITED field with a negative varint-encoded length. The fix adds a length >= 0 guard in ProtoReader.skipGroup() before reading the data.

Affected products

Square Wire 6.4.0 and earlier, 7.0.0-alpha03 and earlier

Identifiers

CVE-2026-61695
GHSA-86wm-r4c5-2rc9

Timeline

2026-09-23: disclosed
2026-09-23: patched: Wire 6.4.1 and 7.0.0-alpha04 contain PR #3616

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.