CVE-2026-61695

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Summary

Wire's Swift runtime (Wire SPM/CocoaPods product, implemented by wire-runtime-swift) did not reject a negative LENGTH_DELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup() to read a length-delimited field whose varint decodes to a negative Int32. That negative value was then passed to ReadBuffer.readData(count:).

ReadBuffer checked only that the requested read did not go past the end of the buffer. It did not reject negative counts. As a result, a negative count could pass the bounds check and reach Foundation's Data(bytes:count:), which traps and aborts the process (Signal 5 / SIGTRAP) instead of throwing Wire's documented ProtoDecoder.Error.

This is the Swift sibling of the Kotlin/JVM negative-length-in-skipGroup() issue fixed in com.squareup.wire:wire-runtime 6.3.0 (CVE-2026-45799, GHSA-7xpr-hc2w-34m9). That earlier fix added a length < 0 rejection to the Kotlin readers. The functionally similar Swift ProtoReader.skipGroup() path was not covered by that fix and remained vulnerable in released Swift runtime versions through 6.4.0, and in Wire 7 alpha releases through 7.0.0-alpha03.

The issue is fixed for the supported 6.x release line in Wire 6.4.1.

skipGroup() runs for any unknown field with wire type 3 (START_GROUP), so no schema knowledge is required. A service decoding any message type with ProtoDecoder.decode(_:from:) over untrusted bytes can be reached by sending an unknown group field.

Impact

Denial of service.

A single 10-byte attacker-controlled protobuf payload can abort the process with an unrecoverable runtime trap. Callers following Wire's documented Swift API generally expect ProtoDecoder.decode(_:from:) to throw catchable decoding errors such as ProtoDecoder.Error. They cannot catch a SIGTRAP from Foundation's Data(bytes:count:).

Any Swift process that decodes untrusted protobuf data with Wire's Swift runtime may be affected. Examples include iOS, macOS, or server-side Swift applications that accept protobuf request bodies, websocket frames, stored messages, queue payloads, files, or any other attacker-controlled serialized protobuf bytes.

The vulnerability requires:

• The application decodes untrusted protobuf bytes with Wire's Swift runtime.
• The attacker can provide a protobuf payload containing an unknown START_GROUP field.
• That group contains a LENGTH_DELIMITED field whose encoded length decodes to a negative signed 32-bit value.

The attacker does not need:

• Authentication.
• User interaction.
• Knowledge of the target message schema.
• A valid known field number in the target schema.

Affected Products

Swift Package Manager / CocoaPods Wire

Affected versions:

• All released Swift runtime versions through 6.4.0.
• Wire 7 alpha releases through 7.0.0-alpha03.

Patched versions:

• 6.4.1 for the supported 6.x release line.
• 7.0.0-alpha04 for the 7.x alpha line (the first 7.x release containing PR #3616).

Recommended action:

• Upgrade to Wire 6.4.1 or later on the supported stable line.
• If using a Wire 7 alpha release, upgrade to 7.0.0-alpha04 or a later 7.x release containing PR #3616.

Vulnerable Code

The vulnerable code was in wire-runtime-swift/src/main/swift/ProtoCodable/ProtoReader.swift, skipGroup(expectedEndTag:unknownFieldsWriter:):

case .lengthDelimited:
    let length = try Int32(truncatingIfNeeded: buffer.readVarint()) // can be negative, e.g. -128
    state = .lengthDelimited(length: Int(length))
    let data = try readData()                                       // no length >= 0 check
    try unknownFieldsWriter.encode(tag: tag, value: data)

ProtoReader.readData() then forwarded the stored negative length to the buffer:

func readData() throws -> Data {
    guard case let .lengthDelimited(length) = state else {
        fatalError("Decoding field as…

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Summary

Wire's Swift runtime (Wire SPM/CocoaPods product, implemented by wire-runtime-swift) did not reject a negative LENGTH_DELIMITED field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause ProtoReader.skipGroup() to read a length-delimited field whose varint decodes to a negative Int32. That negative value was then passed to ReadBuffer.readData(count:).

ReadBuffer checked only that the requested read did not go past the end of the buffer. It did not reject negative counts. As a result, a negative count could pass the bounds check and reach Foundation's Data(bytes:count:), which traps and aborts the process (Signal 5 / SIGTRAP) instead of throwing Wire's documented ProtoDecoder.Error.

This is the Swift sibling of the Kotlin/JVM negative-length-in-skipGroup() issue fixed in com.squareup.wire:wire-runtime 6.3.0 (CVE-2026-45799, GHSA-7xpr-hc2w-34m9). That earlier fix added a length < 0 rejection to the Kotlin readers. The functionally similar Swift ProtoReader.skipGroup() path was not covered by that fix and remained vulnerable in released Swift runtime versions through 6.4.0, and in Wire 7 alpha releases through 7.0.0-alpha03.

The issue is fixed for the supported 6.x release line in Wire 6.4.1.

skipGroup() runs for any unknown field with wire type 3 (START_GROUP), so no schema knowledge is required. A service decoding any message type with ProtoDecoder.decode(_:from:) over untrusted bytes can be reached by sending an unknown group field.

Impact

Denial of service.

A single 10-byte attacker-controlled protobuf payload can abort the process with an unrecoverable runtime trap. Callers following Wire's documented Swift API generally expect ProtoDecoder.decode(_:from:) to throw catchable decoding errors such as ProtoDecoder.Error. They cannot catch a SIGTRAP from Foundation's Data(bytes:count:).

Any Swift process that decodes untrusted protobuf data with Wire's Swift runtime may be affected. Examples include iOS, macOS, or server-side Swift applications that accept protobuf request bodies, websocket frames, stored messages, queue payloads, files, or any other attacker-controlled serialized protobuf bytes.

The vulnerability requires:

• The application decodes untrusted protobuf bytes with Wire's Swift runtime.
• The attacker can provide a protobuf payload containing an unknown START_GROUP field.
• That group contains a LENGTH_DELIMITED field whose encoded length decodes to a negative signed 32-bit value.

The attacker does not need:

• Authentication.
• User interaction.
• Knowledge of the target message schema.
• A valid known field number in the target schema.

Affected Products

Swift Package Manager / CocoaPods Wire

Affected versions:

• All released Swift runtime versions through 6.4.0.
• Wire 7 alpha releases through 7.0.0-alpha03.

Patched versions:

• 6.4.1 for the supported 6.x release line.
• 7.0.0-alpha04 for the 7.x alpha line (the first 7.x release containing PR #3616).

Recommended action:

• Upgrade to Wire 6.4.1 or later on the supported stable line.
• If using a Wire 7 alpha release, upgrade to 7.0.0-alpha04 or a later 7.x release containing PR #3616.

Vulnerable Code

The vulnerable code was in wire-runtime-swift/src/main/swift/ProtoCodable/ProtoReader.swift, skipGroup(expectedEndTag:unknownFieldsWriter:):

case .lengthDelimited:
    let length = try Int32(truncatingIfNeeded: buffer.readVarint()) // can be negative, e.g. -128
    state = .lengthDelimited(length: Int(length))
    let data = try readData()                                       // no length >= 0 check
    try unknownFieldsWriter.encode(tag: tag, value: data)

ProtoReader.readData() then forwarded the stored negative length to the buffer:

func readData() throws -> Data {
    guard case let .lengthDelimited(length) = state else {
        fatalError("Decoding field as…