# CVE-2026-61695: Square Wire Swift runtime negative length in skipGroup() denial of service

Source: https://junglewise.ai/threats/cve-2026-61695-square-wire-swift-runtime-negative-length-in-skipgroup-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61695 · Severity: high · CVSS 7.5 · Published 2026-09-23

Wire is a popular serialization library used by iOS, macOS, and server-side Swift applications to decode messages. A malformed protobuf payload with a negative length field can cause the Swift runtime to crash with an unrecoverable trap instead of throwing a catchable error, leaving applications unable to recover from the malicious input. This affects any application decoding untrusted protobuf data.

Vendors: [Swift](https://junglewise.ai/threats/vendors/swift).

## Quick answers

**Is CVE-2026-61695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61695 being exploited in the wild.

**How severe is CVE-2026-61695?** High severity, with a CVSS score of 7.5, published 23 September 2026.

**Which products and versions are affected?** github.com/square/wire (Swift) <= 6.4.0.

**Is there a fix for CVE-2026-61695?** A patch was published on 2026-09-23: Wire 6.4.1 and 7.0.0-alpha04 contain PR #3616 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61695 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61695?** Check whether you run github.com/square/wire (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing validation in ProtoReader.skipGroup() that failed to reject negative LENGTH_DELIMITED field lengths when skipping unknown protobuf groups. A crafted 10-byte payload with a varint-encoded negative Int32 length is passed directly to ReadBuffer.readData(count:), which only checks the upper bound. The negative count bypasses the bounds check and reaches Foundation's Data(bytes:count:), which traps with SIGTRAP instead of throwing a ProtoDecoder.Error. No authentication, user interaction, or schema knowledge is required; the attacker only needs to send an unknown START_GROUP field containing a LENGTH_DELIMITED field with a negative varint-encoded length. The fix adds a length >= 0 guard in ProtoReader.skipGroup() before reading the data.

## Affected products

- Square Wire 6.4.0 and earlier, 7.0.0-alpha03 and earlier

## Identifiers

- CVE-2026-61695
- GHSA-86wm-r4c5-2rc9

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Wire 6.4.1 and 7.0.0-alpha04 contain PR #3616