Executive brief
Wire is a popular serialization library used by iOS, macOS, and server-side Swift applications to decode messages. A malformed protobuf payload with a negative length field can cause the Swift runtime to crash with an unrecoverable trap instead of throwing a catchable error, leaving applications unable to recover from the malicious input. This affects any application decoding untrusted protobuf data.
Technical details
The vulnerability is a missing validation in ProtoReader.skipGroup() that failed to reject negative LENGTH_DELIMITED field lengths when skipping unknown protobuf groups. A crafted 10-byte payload with a varint-encoded negative Int32 length is passed directly to ReadBuffer.readData(count:), which only checks the upper bound. The negative count bypasses the bounds check and reaches Foundation's Data(bytes:count:), which traps with SIGTRAP instead of throwing a ProtoDecoder.Error. No authentication, user interaction, or schema knowledge is required; the attacker only needs to send an unknown START_GROUP field containing a LENGTH_DELIMITED field with a negative varint-encoded length. The fix adds a length >= 0 guard in ProtoReader.skipGroup() before reading the data.
Affected products
- Square Wire 6.4.0 and earlier, 7.0.0-alpha03 and earlier
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Wire 6.4.1 and 7.0.0-alpha04 contain PR #3616