CVE-2026-63126

Square's Wire library, a protobuf and gRPC runtime for Android, Kotlin, Java, and Swift, does not consistently validate attacker-controlled length fields against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations (CWE-190, integer overflow/wraparound). In the Kotlin runtime, a positive oversized length in ByteArrayProtoReader32.internalNextLengthDelimited() (reachable via ProtoAdapter.decode(ByteArray) and decode(ByteString)) can wrap pos + length to a negative limit and bypass the existing negative-length check, with similar boundary-crossing, pointer-arithmetic, capacity-reservation, and unrepresentable-size-conversion issues in ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated and nested-message handling, and ProtoDecoder.decodeSizeDelimited(_:from:). An attacker who can supply malformed protobuf bytes to any affected decode path, typically over the network where apps or services parse untrusted protobuf, can trigger unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, causing denial of service with no known confidentiality, integrity, or code-execution impact. All applications and services built with Wire versions prior to 6.4.5, or 7.0.0-alpha pre-releases prior to 7.0.0-alpha04, are affected. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported.

What to do: Upgrade Wire to 6.4.5 on the stable line, or to 7.0.0-alpha04 or later on the alpha line. Audit code paths that decode attacker-controlled protobuf bytes — especially ProtoAdapter.decode(ByteArray)/decode(ByteString) and ProtoDecoder.decodeSizeDelimited(_:from:) — and enforce application-level message-size limits or crash handling around decoding. Services that only exchange protobuf with trusted peers face materially lower risk since exploitation requires malformed input to reach these decoders.