Vulnerability-Lookup

GHSA-9RM7-3QHH-H2MC

Vulnerability from github – Published: 2026-09-17 14:52 – Updated: 2026-09-17 14:52

Summary

Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Details

Wire's protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions.

In the Kotlin runtime, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use the ProtoReader32 fast path implemented by ByteArrayProtoReader32. In ByteArrayProtoReader32.internalNextLengthDelimited(), Wire read an untrusted varint length into an Int and rejected only negative values. A length such as 2147483647 is non-negative, so it passed that check, but pos + length overflowed the signed 32-bit cursor and produced a negative limit. The following if (limit > pushedLimit) guard did not catch this because the overflowed value was negative.

That invalid limit then reached string, bytes, skip, and scalar-reading paths as an invalid byte count or invalid range. Instead of failing as a checked decode error such as IOException, malformed input could throw unchecked runtime exceptions including IllegalArgumentException and ArrayIndexOutOfBoundsException. Applications commonly treat malformed protobuf input as an expected decode failure; unchecked runtime exceptions escaping that boundary can crash request handling or the process.

The original report is a sibling of the negative-length skipped-group bug fixed as CVE-2026-45799. It is not the same bug. The length in this advisory is positive, and the overflow occurs when setting a length-delimited message limit, not only when skipping a group.

While auditing for the same bug class, related boundary flaws were also found and fixed:

Kotlin ProtoReader now validates logical message limits before varint, fixed32, fixed64, and skip operations. The originally reported byte-array overflow payload did not reproduce as the same signed overflow in ProtoReader, because that reader tracks positions as Long, but the streaming reader still needed consistent current-message-limit enforcement.
Swift ReadBuffer.readVarint() read pointer.pointee before checking that one byte remained. A tag-only varint field could read past the end of the buffer.
Swift ReadBuffer.verifyAdditional(count:) formed pointer.advanced(by: count) before proving the requested count fit within the remaining buffer, so pointer arithmetic ran before the bounds were established. (The distinct Swift negative-length skipGroup() crash is tracked separately as GHSA-86wm-r4c5-2rc9 / CVE-2026-61695; this advisory covers the positive/oversized-length boundary failures.)
Swift nested-message decoding and packed-repeated decoding computed end pointers from untrusted lengths before validating that the bytes were present.
Swift packed-repeated decoding reserved array capacity from an untrusted length before validating that the length existed in the current buffer.
Swift size-delimited decoding converted an untrusted UInt64 varint size to Int without exactness or availability checks. On platforms where the value is not representable, this could trap.

The fix enforces a single invariant across the hardened readers: every decoded or skipped byte count must be non-negative and no larger than the remaining bytes in the current logical message limit before any cursor, pointer, limit, allocation, or slice is advanced.

Impact

An attacker who can supply protobuf bytes to an application using affected Wire decoders can trigger a denial of service by causing decode to fail with unchecked runtime failures or traps rather than normal malformed-input decode errors.

Known impact:

Availability impact only.
No known confidentiality impact.
No known integrity impact.
No known code execution.

Attack requirements:

The application decodes attacker-controlled protobuf bytes with Wire.
No authentication is required if the decoding endpoint is reachable without authentication.
A single short malformed protobuf payload is sufficient for the Kotlin byte-array fast path.

Most directly affected Kotlin entry points:

ProtoAdapter.decode(ByteArray)
ProtoAdapter.decode(ByteString)

Adjacent Kotlin path hardened by this fix:

ProtoAdapter.decode(BufferedSource)
direct use of ProtoReader

Affected Swift entry points:

Swift ProtoDecoder and ProtoReader APIs when decoding attacker-controlled Data or buffers.

Proof of concept and regression payloads

These payloads are intentionally small and should be treated as malformed protobuf input. After the fix, they must fail with normal decode errors such as IOException, EOFException, or ProtoDecoder.Error.unexpectedEndOfData, not unchecked runtime exceptions, traps, out-of-bounds reads, or large allocations.

Kotlin byte-array known length-delimited field

Hex:

0A FF FF FF FF 07

Meaning:

0A: field 1, length-delimited
FF FF FF FF 07: varint length 2147483647

Pre-fix behavior observed through Person.ADAPTER.decode(byteArray):

java.lang.IllegalArgumentException: startIndex: 6 > endIndex: -2147483643

Expected fixed behavior:

IOException / EOFException

Kotlin byte-array unknown length-delimited field

Hex:

1A FF FF FF FF 07

Meaning:

1A: field 3, length-delimited
FF FF FF FF 07: varint length 2147483647

Pre-fix behavior observed:

ArrayIndexOutOfBoundsException

Expected fixed behavior:

IOException / EOFException

Kotlin byte-array skipped group containing oversized positive length

Hex:

0B 0A FF FF FF FF 07 0C

Meaning:

0B: start group, field 1
0A: nested field 1, length-delimited
FF FF FF FF 07: varint length 2147483647
0C: end group, field 1

Expected fixed behavior:

IOException / EOFException

Kotlin current-message-limit fixed32 boundary

Hex:

02 0D 05 00 00 00

Meaning:

02: outer length-delimited message length is 2 bytes
0D: nested field 1, fixed32
05 00 00 00: enough bytes remain in the underlying source, but not inside the current logical message limit

Expected fixed behavior:

EOFException

This covers the invariant that scalar reads must not cross the current length-delimited message boundary even when the underlying source has more bytes available.

Swift tag-only varint value

Hex:

Meaning:

08: field 1, varint
Missing varint value byte

Pre-fix risk:

ReadBuffer.readVarint() could dereference pointer.pointee before verifying that a byte remained.

Expected fixed behavior:

ProtoDecoder.Error.unexpectedEndOfData

Swift nested message with oversized positive length

Hex:

12 FF FF FF FF 07

Meaning:

12: field 2, length-delimited
FF FF FF FF 07: varint length 2147483647

Pre-fix risk:

Nested message decoding computed an end pointer from an untrusted length before proving that the buffer contained that many bytes.

Expected fixed behavior:

ProtoDecoder.Error.unexpectedEndOfData

Swift packed repeated field with oversized positive length

Hex:

0A FF FF FF FF 07

Meaning:

0A: field 1, length-delimited packed repeated field
FF FF FF FF 07: varint length 2147483647

Pre-fix risk:

Packed repeated decoding could reserve capacity based on an untrusted length before proving the bytes were present.

Expected fixed behavior:

ProtoDecoder.Error.unexpectedEndOfData

Swift size-delimited stream with unrepresentable size

Hex:

FF FF FF FF FF FF FF FF FF 01

Meaning:

Size-delimited message length varint UInt64.max

Pre-fix risk:

ProtoDecoder.decodeSizeDelimited(_:from:) converted the untrusted UInt64 to Int without exactness checking.

Expected fixed behavior:

ProtoDecoder.Error.unexpectedEndOfData

Root cause

The vulnerable code mixed three operations that must remain separate:

Decode an untrusted protobuf length.
Validate that the length is non-negative and fits within the current logical message boundary.
Advance the cursor, pointer, limit, slice, or allocation based on that length.

In the vulnerable paths, step 3 happened before step 2 was complete. For Kotlin ByteArrayProtoReader32, this caused signed integer wraparound in pos + length. For Swift, related pointer and allocation operations could be performed before proving the requested bytes existed.

Fix

The fix centralizes checked cursor and pointer advancement.

Kotlin changes:

ByteArrayProtoReader32 now validates constructor invariants for pos and limit.
ByteArrayProtoReader32 now uses shared helpers to:
reject negative lengths,
compute checked limits,
compute remaining bytes in the current logical limit,
validate before skip,
validate before string and bytes reads,
validate before fixed32 and fixed64 reads.
ProtoReader now mirrors the same logical-boundary model for:
length-delimited limit calculation,
skipped length-delimited fields,
varint reads,
fixed32 reads,
fixed64 reads,
current-message remaining-byte calculations.

Swift changes:

ReadBuffer now computes checked end pointers only after confirming count >= 0 and count <= remaining.
ReadBuffer.readVarint() verifies one byte remains before each byte dereference.
ReadBuffer.readBuffer(count:), readData(count:), readFixed32(), and readFixed64() compute the checked new pointer before reading and advancing.
ProtoReader.beginMessage() validates nested message lengths before storing a message-end pointer.
Packed repeated decoding validates the packed field length before preallocation and before constructing the loop boundary.
ProtoDecoder.decodeSizeDelimited(_:from:) converts sizes with Int(exactly:) and verifies that the full message bytes exist before constructing a child buffer.

Fixed in PR #3635:

https://github.com/square/wire/pull/3635
Fix commit 25ebcabb9ab7f12d1d77af75ecbc51726fddc015

Workarounds

The recommended remediation is to upgrade to a patched release.

Partial mitigations if an immediate upgrade is not possible:

Reject or cap untrusted protobuf message sizes before passing bytes to Wire.
Prefer decoding from a bounded source where possible rather than decoding unbounded attacker-controlled byte arrays.
Treat unchecked runtime exceptions from protobuf decode as malformed-input failures at service trust boundaries so they cannot crash the process.
For Swift, do not pass untrusted size-delimited streams or Data directly to affected decoders without an outer size cap and exception/error boundary.

These mitigations reduce exposure but do not fully fix the parser bugs.

Detection

A crash or error may contain one of the following symptoms when processing malformed protobuf bytes:

IllegalArgumentException: startIndex: 6 > endIndex: -2147483643
ArrayIndexOutOfBoundsException
IndexOutOfBoundsException
unexpected unchecked RuntimeException during ProtoAdapter.decode(ByteArray)
Swift trap during Int conversion from an untrusted protobuf size
Swift unexpected pointer/buffer failure while reading malformed varints or length-delimited values

The absence of these exact messages does not prove safety. Any unchecked exception, trap, or process crash while decoding malformed length-delimited protobuf input should be investigated.

Verification

Regression tests added:

ProtoReader32Test.lengthDelimitedRejectsPositiveLengthOverflow
ProtoReader32Test.fixed32CannotReadPastLengthDelimitedLimit
ProtoReaderTest.fixed32CannotReadPastLengthDelimitedLimit
ProtoReaderTests.testReadVarintRejectsMissingValue
ProtoReaderTests.testNestedMessageRejectsOversizedLength
ProtoReaderTests.testPackedRepeatedRejectsOversizedLengthBeforePreallocation
ProtoDecoderTests.testDecodeSizeDelimitedRejectsUnrepresentableSize

Focused verification command:

./gradlew :wire-runtime:jvmTest :wire-runtime-swift:test

Expected result:

BUILD SUCCESSFUL

Relationship to related advisories

This is a distinct vulnerability from the negative-length issues. It is a different bug class — a positive, non-negative length (for example 2147483647) that passes the existing length < 0 check but still overflows the signed 32-bit cursor or crosses the current message boundary — and it has a separate fix (PR #3635, not the negative-length PRs).

CVE-2026-45799 / GHSA-7xpr-hc2w-34m9 fixed the original Kotlin/JVM negative-length skipped-group crash (Wire 6.3.0). The non-negative overflow described here was not covered by that check and remained exploitable through 6.4.4.
GHSA-86wm-r4c5-2rc9 / CVE-2026-61695 covers the Swift negative-length skipGroup() crash (PR #3616). The Swift hardening in this advisory (PR #3635) instead addresses positive/oversized-length overflow, buffer over-read, and unrepresentable-size conversions in the Swift readers.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.4.4"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.squareup.wire:wire-runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.squareup.wire:wire-runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0-alpha01"
            },
            {
              "fixed": "7.0.0-alpha04"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63126"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:52:52Z",
    "nvd_published_at": "2026-09-16T19:17:24Z",
    "severity": "HIGH"
  },
  "details": "Wire\u0027s protobuf decoders did not consistently validate attacker-controlled length-delimited sizes against the current reader bounds before computing cursor, limit, or pointer positions.\n\nIn the Kotlin runtime, `ProtoAdapter.decode(ByteArray)` and `ProtoAdapter.decode(ByteString)` use the `ProtoReader32` fast path implemented by `ByteArrayProtoReader32`. In `ByteArrayProtoReader32.internalNextLengthDelimited()`, Wire read an untrusted varint length into an `Int` and rejected only negative values. A length such as `2147483647` is non-negative, so it passed that check, but `pos + length` overflowed the signed 32-bit cursor and produced a negative `limit`. The following `if (limit \u003e pushedLimit)` guard did not catch this because the overflowed value was negative.\n\nThat invalid limit then reached string, bytes, skip, and scalar-reading paths as an invalid byte count or invalid range. Instead of failing as a checked decode error such as `IOException`, malformed input could throw unchecked runtime exceptions including `IllegalArgumentException` and `ArrayIndexOutOfBoundsException`. Applications commonly treat malformed protobuf input as an expected decode failure; unchecked runtime exceptions escaping that boundary can crash request handling or the process.\n\nThe original report is a sibling of the negative-length skipped-group bug fixed as CVE-2026-45799. It is not the same bug. The length in this advisory is positive, and the overflow occurs when setting a length-delimited message limit, not only when skipping a group.\n\nWhile auditing for the same bug class, related boundary flaws were also found and fixed:\n\n- Kotlin `ProtoReader` now validates logical message limits before varint, fixed32, fixed64, and skip operations. The originally reported byte-array overflow payload did not reproduce as the same signed overflow in `ProtoReader`, because that reader tracks positions as `Long`, but the streaming reader still needed consistent current-message-limit enforcement.\n- Swift `ReadBuffer.readVarint()` read `pointer.pointee` before checking that one byte remained. A tag-only varint field could read past the end of the buffer.\n- Swift `ReadBuffer.verifyAdditional(count:)` formed `pointer.advanced(by: count)` before proving the requested `count` fit within the remaining buffer, so pointer arithmetic ran before the bounds were established. (The distinct Swift negative-length `skipGroup()` crash is tracked separately as GHSA-86wm-r4c5-2rc9 / CVE-2026-61695; this advisory covers the positive/oversized-length boundary failures.)\n- Swift nested-message decoding and packed-repeated decoding computed end pointers from untrusted lengths before validating that the bytes were present.\n- Swift packed-repeated decoding reserved array capacity from an untrusted length before validating that the length existed in the current buffer.\n- Swift size-delimited decoding converted an untrusted `UInt64` varint size to `Int` without exactness or availability checks. On platforms where the value is not representable, this could trap.\n\nThe fix enforces a single invariant across the hardened readers: every decoded or skipped byte count must be non-negative and no larger than the remaining bytes in the current logical message limit before any cursor, pointer, limit, allocation, or slice is advanced.\n\n### Impact\n\nAn attacker who can supply protobuf bytes to an application using affected Wire decoders can trigger a denial of service by causing decode to fail with unchecked runtime failures or traps rather than normal malformed-input decode errors.\n\nKnown impact:\n\n- Availability impact only.\n- No known confidentiality impact.\n- No known integrity impact.\n- No known code execution.\n\nAttack requirements:\n\n- The application decodes attacker-controlled protobuf bytes with Wire.\n- No authentication is required if the decoding endpoint is reachable without authentication.\n- A single short malformed protobuf payload is sufficient for the Kotlin byte-array fast path.\n\nMost directly affected Kotlin entry points:\n\n- `ProtoAdapter.decode(ByteArray)`\n- `ProtoAdapter.decode(ByteString)`\n\nAdjacent Kotlin path hardened by this fix:\n\n- `ProtoAdapter.decode(BufferedSource)`\n- direct use of `ProtoReader`\n\nAffected Swift entry points:\n\n- Swift `ProtoDecoder` and `ProtoReader` APIs when decoding attacker-controlled `Data` or buffers.\n\n### Proof of concept and regression payloads\n\nThese payloads are intentionally small and should be treated as malformed protobuf input. After the fix, they must fail with normal decode errors such as `IOException`, `EOFException`, or `ProtoDecoder.Error.unexpectedEndOfData`, not unchecked runtime exceptions, traps, out-of-bounds reads, or large allocations.\n\n#### Kotlin byte-array known length-delimited field\n\nHex:\n\n```text\n0A FF FF FF FF 07\n```\n\nMeaning:\n\n- `0A`: field 1, length-delimited\n- `FF FF FF FF 07`: varint length `2147483647`\n\nPre-fix behavior observed through `Person.ADAPTER.decode(byteArray)`:\n\n```text\njava.lang.IllegalArgumentException: startIndex: 6 \u003e endIndex: -2147483643\n```\n\nExpected fixed behavior:\n\n```text\nIOException / EOFException\n```\n\n#### Kotlin byte-array unknown length-delimited field\n\nHex:\n\n```text\n1A FF FF FF FF 07\n```\n\nMeaning:\n\n- `1A`: field 3, length-delimited\n- `FF FF FF FF 07`: varint length `2147483647`\n\nPre-fix behavior observed:\n\n```text\nArrayIndexOutOfBoundsException\n```\n\nExpected fixed behavior:\n\n```text\nIOException / EOFException\n```\n\n#### Kotlin byte-array skipped group containing oversized positive length\n\nHex:\n\n```text\n0B 0A FF FF FF FF 07 0C\n```\n\nMeaning:\n\n- `0B`: start group, field 1\n- `0A`: nested field 1, length-delimited\n- `FF FF FF FF 07`: varint length `2147483647`\n- `0C`: end group, field 1\n\nExpected fixed behavior:\n\n```text\nIOException / EOFException\n```\n\n#### Kotlin current-message-limit fixed32 boundary\n\nHex:\n\n```text\n02 0D 05 00 00 00\n```\n\nMeaning:\n\n- `02`: outer length-delimited message length is 2 bytes\n- `0D`: nested field 1, fixed32\n- `05 00 00 00`: enough bytes remain in the underlying source, but not inside the current logical message limit\n\nExpected fixed behavior:\n\n```text\nEOFException\n```\n\nThis covers the invariant that scalar reads must not cross the current length-delimited message boundary even when the underlying source has more bytes available.\n\n#### Swift tag-only varint value\n\nHex:\n\n```text\n08\n```\n\nMeaning:\n\n- `08`: field 1, varint\n- Missing varint value byte\n\nPre-fix risk:\n\n- `ReadBuffer.readVarint()` could dereference `pointer.pointee` before verifying that a byte remained.\n\nExpected fixed behavior:\n\n```text\nProtoDecoder.Error.unexpectedEndOfData\n```\n\n#### Swift nested message with oversized positive length\n\nHex:\n\n```text\n12 FF FF FF FF 07\n```\n\nMeaning:\n\n- `12`: field 2, length-delimited\n- `FF FF FF FF 07`: varint length `2147483647`\n\nPre-fix risk:\n\n- Nested message decoding computed an end pointer from an untrusted length before proving that the buffer contained that many bytes.\n\nExpected fixed behavior:\n\n```text\nProtoDecoder.Error.unexpectedEndOfData\n```\n\n#### Swift packed repeated field with oversized positive length\n\nHex:\n\n```text\n0A FF FF FF FF 07\n```\n\nMeaning:\n\n- `0A`: field 1, length-delimited packed repeated field\n- `FF FF FF FF 07`: varint length `2147483647`\n\nPre-fix risk:\n\n- Packed repeated decoding could reserve capacity based on an untrusted length before proving the bytes were present.\n\nExpected fixed behavior:\n\n```text\nProtoDecoder.Error.unexpectedEndOfData\n```\n\n#### Swift size-delimited stream with unrepresentable size\n\nHex:\n\n```text\nFF FF FF FF FF FF FF FF FF 01\n```\n\nMeaning:\n\n- Size-delimited message length varint `UInt64.max`\n\nPre-fix risk:\n\n- `ProtoDecoder.decodeSizeDelimited(_:from:)` converted the untrusted `UInt64` to `Int` without exactness checking.\n\nExpected fixed behavior:\n\n```text\nProtoDecoder.Error.unexpectedEndOfData\n```\n\n### Root cause\n\nThe vulnerable code mixed three operations that must remain separate:\n\n1. Decode an untrusted protobuf length.\n2. Validate that the length is non-negative and fits within the current logical message boundary.\n3. Advance the cursor, pointer, limit, slice, or allocation based on that length.\n\nIn the vulnerable paths, step 3 happened before step 2 was complete. For Kotlin `ByteArrayProtoReader32`, this caused signed integer wraparound in `pos + length`. For Swift, related pointer and allocation operations could be performed before proving the requested bytes existed.\n\n### Fix\n\nThe fix centralizes checked cursor and pointer advancement.\n\nKotlin changes:\n\n- `ByteArrayProtoReader32` now validates constructor invariants for `pos` and `limit`.\n- `ByteArrayProtoReader32` now uses shared helpers to:\n  - reject negative lengths,\n  - compute checked limits,\n  - compute remaining bytes in the current logical limit,\n  - validate before `skip`,\n  - validate before string and bytes reads,\n  - validate before fixed32 and fixed64 reads.\n- `ProtoReader` now mirrors the same logical-boundary model for:\n  - length-delimited limit calculation,\n  - skipped length-delimited fields,\n  - varint reads,\n  - fixed32 reads,\n  - fixed64 reads,\n  - current-message remaining-byte calculations.\n\nSwift changes:\n\n- `ReadBuffer` now computes checked end pointers only after confirming `count \u003e= 0` and `count \u003c= remaining`.\n- `ReadBuffer.readVarint()` verifies one byte remains before each byte dereference.\n- `ReadBuffer.readBuffer(count:)`, `readData(count:)`, `readFixed32()`, and `readFixed64()` compute the checked new pointer before reading and advancing.\n- `ProtoReader.beginMessage()` validates nested message lengths before storing a message-end pointer.\n- Packed repeated decoding validates the packed field length before preallocation and before constructing the loop boundary.\n- `ProtoDecoder.decodeSizeDelimited(_:from:)` converts sizes with `Int(exactly:)` and verifies that the full message bytes exist before constructing a child buffer.\n\nFixed in PR #3635:\n\n- https://github.com/square/wire/pull/3635\n- Fix commit `25ebcabb9ab7f12d1d77af75ecbc51726fddc015`\n\n### Workarounds\n\nThe recommended remediation is to upgrade to a patched release.\n\nPartial mitigations if an immediate upgrade is not possible:\n\n- Reject or cap untrusted protobuf message sizes before passing bytes to Wire.\n- Prefer decoding from a bounded source where possible rather than decoding unbounded attacker-controlled byte arrays.\n- Treat unchecked runtime exceptions from protobuf decode as malformed-input failures at service trust boundaries so they cannot crash the process.\n- For Swift, do not pass untrusted size-delimited streams or `Data` directly to affected decoders without an outer size cap and exception/error boundary.\n\nThese mitigations reduce exposure but do not fully fix the parser bugs.\n\n### Detection\n\nA crash or error may contain one of the following symptoms when processing malformed protobuf bytes:\n\n```text\nIllegalArgumentException: startIndex: 6 \u003e endIndex: -2147483643\nArrayIndexOutOfBoundsException\nIndexOutOfBoundsException\nunexpected unchecked RuntimeException during ProtoAdapter.decode(ByteArray)\nSwift trap during Int conversion from an untrusted protobuf size\nSwift unexpected pointer/buffer failure while reading malformed varints or length-delimited values\n```\n\nThe absence of these exact messages does not prove safety. Any unchecked exception, trap, or process crash while decoding malformed length-delimited protobuf input should be investigated.\n\n### Verification\n\nRegression tests added:\n\n- `ProtoReader32Test.lengthDelimitedRejectsPositiveLengthOverflow`\n- `ProtoReader32Test.fixed32CannotReadPastLengthDelimitedLimit`\n- `ProtoReaderTest.fixed32CannotReadPastLengthDelimitedLimit`\n- `ProtoReaderTests.testReadVarintRejectsMissingValue`\n- `ProtoReaderTests.testNestedMessageRejectsOversizedLength`\n- `ProtoReaderTests.testPackedRepeatedRejectsOversizedLengthBeforePreallocation`\n- `ProtoDecoderTests.testDecodeSizeDelimitedRejectsUnrepresentableSize`\n\nFocused verification command:\n\n```bash\n./gradlew :wire-runtime:jvmTest :wire-runtime-swift:test\n```\n\nExpected result:\n\n```text\nBUILD SUCCESSFUL\n```\n\n### Relationship to related advisories\n\nThis is a distinct vulnerability from the negative-length issues. It is a\ndifferent bug class \u2014 a positive, non-negative length (for example\n`2147483647`) that passes the existing `length \u003c 0` check but still overflows\nthe signed 32-bit cursor or crosses the current message boundary \u2014 and it has\na separate fix (PR #3635, not the negative-length PRs).\n\n- `CVE-2026-45799` / `GHSA-7xpr-hc2w-34m9` fixed the original Kotlin/JVM\n  negative-length skipped-group crash (Wire `6.3.0`). The non-negative\n  overflow described here was not covered by that check and remained\n  exploitable through `6.4.4`.\n- `GHSA-86wm-r4c5-2rc9` / `CVE-2026-61695` covers the Swift negative-length\n  `skipGroup()` crash (PR #3616). The Swift hardening in this advisory\n  (PR #3635) instead addresses positive/oversized-length overflow, buffer\n  over-read, and unrepresentable-size conversions in the Swift readers.",
  "id": "GHSA-9rm7-3qhh-h2mc",
  "modified": "2026-09-17T14:52:52Z",
  "published": "2026-09-17T14:52:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63126"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/wire/pull/3635"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/wire/commit/25ebcabb9ab7f12d1d77af75ecbc51726fddc015"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/square/wire"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/wire/releases/tag/6.4.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)"
}

CVE-2026-63126 (GCVE-0-2026-63126)

Vulnerability from cvelistv5 – Published: 2026-09-16 18:13 – Updated: 2026-09-16 19:41

Title

Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)

Summary

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:41 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/square/wire/security/advisorie…	x_refsource_CONFIRM
https://github.com/square/wire/pull/3635	x_refsource_MISC
https://github.com/square/wire/commit/082d5d83cec…	x_refsource_MISC
https://github.com/square/wire/commit/25ebcabb9ab…	x_refsource_MISC
https://github.com/square/wire/releases/tag/6.4.5	x_refsource_MISC
https://github.com/square/wire/releases/tag/7.0.0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
square	wire	Affected: < 6.4.5 Affected: >= 7.0.0-alpha01, < 7.0.0-alpha04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63126",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:41:27.470490Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:41:42.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wire",
          "vendor": "square",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0-alpha01, \u003c 7.0.0-alpha04"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T18:13:33.197Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc"
        },
        {
          "name": "https://github.com/square/wire/pull/3635",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/pull/3635"
        },
        {
          "name": "https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f"
        },
        {
          "name": "https://github.com/square/wire/commit/25ebcabb9ab7f12d1d77af75ecbc51726fddc015",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/commit/25ebcabb9ab7f12d1d77af75ecbc51726fddc015"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/6.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/6.4.5"
        },
        {
          "name": "https://github.com/square/wire/releases/tag/7.0.0-alpha04",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha04"
        }
      ],
      "source": {
        "advisory": "GHSA-9rm7-3qhh-h2mc",
        "discovery": "UNKNOWN"
      },
      "title": "Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63126",
    "datePublished": "2026-09-16T18:13:33.197Z",
    "dateReserved": "2026-07-15T16:54:55.816Z",
    "dateUpdated": "2026-09-16T19:41:42.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-9RM7-3QHH-H2MC

Impact

Proof of concept and regression payloads

Kotlin byte-array known length-delimited field

Kotlin byte-array unknown length-delimited field

Kotlin byte-array skipped group containing oversized positive length

Kotlin current-message-limit fixed32 boundary

Swift tag-only varint value

Swift nested message with oversized positive length

Swift packed repeated field with oversized positive length

Swift size-delimited stream with unrepresentable size

Root cause

Fix

Workarounds

Detection

Verification

Relationship to related advisories

CVE-2026-63126 (GCVE-0-2026-63126)

Tags

Sightings

Nomenclature

Related by attack behaviour