CVE-2026-61695: 
Swift vulnerability analysis and mitigation

CVE-2026-61695 is a denial-of-service vulnerability in the Wire Swift runtime (wire-runtime-swift) caused by improper validation of negative LENGTH_DELIMITED field lengths during protobuf group skipping. When ProtoReader.skipGroup() encounters an unknown START_GROUP field, it reads the inner field's varint length without checking for negative values, ultimately passing a negative count to Foundation's Data(bytes:count:), which triggers an unrecoverable process trap (SIGTRAP) rather than a catchable ProtoDecoder.Error. Affected versions include all Wire Swift runtime releases through 6.4.0 and Wire 7 alpha releases through 7.0.0-alpha03. The vulnerability was published on September 23, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-129 (Improper Validation of Array Index). In ProtoReader.swift, the skipGroup(expectedEndTag:unknownFieldsWriter:) method reads a varint for a LENGTH_DELIMITED field inside an unknown group and casts it to Int32 without checking for negative values. The negative length is stored in state and forwarded to ReadBuffer.readData(count:), whose bounds check (pointer.advanced(by: count) <= end) only validates the upper bound — a negative count passes this guard because subtracting from the pointer still falls within the buffer's address range. The negative count then reaches Foundation.Data(bytes:count:), which does not accept negative sizes and raises an unrecoverable SIGTRAP. The attack requires no authentication, no user interaction, and no knowledge of the target schema, since unknown-field skipping is schema-agnostic. A complete Swift proof-of-concept using a 10-byte crafted payload (0x9B, 0x06, 0x0A, 0x80, 0xFF, 0xFF, 0xFF, 0x0F, 0x9C, 0x06) is included in the advisory (GitHub Advisory, Fix PR).

Successful exploitation results in an unrecoverable process termination (SIGTRAP / Signal 5) in any Swift application decoding untrusted protobuf bytes with the vulnerable Wire runtime. The crash bypasses Wire's documented error-handling contract — callers cannot catch the trap with standard Swift error handling around ProtoDecoder.decode(_:from:). Affected applications include iOS, macOS, and server-side Swift services that accept protobuf request bodies, WebSocket frames, queue payloads, stored messages, or any other attacker-controlled serialized protobuf data. There is no confidentiality or integrity impact; the sole consequence is availability loss (denial of service) (GitHub Advisory).

A public proof-of-concept exploit is available within the official security advisory, consisting of a complete, runnable Swift program that demonstrates the crash with a 10-byte payload. The vulnerability is network-exploitable with no authentication or user interaction required, and the NVD SSVC assessment classifies it as automatable with PoC-level exploitation. The EPSS score is approximately 0.0058 (0.58%), and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the advisory date. No threat actor attribution has been reported (GitHub Advisory).

1. Identify target: Locate a Swift application (iOS, macOS, or server-side) that uses Wire's Swift runtime (version ≤ 6.4.0 or 7.0.0-alpha01 through 7.0.0-alpha03) and accepts untrusted protobuf-encoded input over a network interface.
2. Craft the malicious payload: Construct a 10-byte protobuf binary message encoding field 99 as a START_GROUP (wire type 3), containing an inner LENGTH_DELIMITED field (field 1, wire type 2) whose varint length encodes to signed Int32 value -128, followed by the matching END_GROUP tag:

   Hex: 9B 06 0A 80 FF FF FF 0F 9C 06

   • 0x9B 0x06 — field 99, wire type 3 (START_GROUP)
   • 0x0A — field 1, wire type 2 (LENGTH_DELIMITED)
   • 0x80 0xFF 0xFF 0xFF 0x0F — 5-byte varint encoding signed Int32 = -128
   • 0x9C 0x06 — field 99, END_GROUP
3. Deliver the payload: Send the crafted bytes to any endpoint where the target application calls ProtoDecoder.decode(_:from:) on attacker-controlled data (e.g., HTTP request body, WebSocket frame, gRPC message).
4. Trigger the crash: The Wire runtime's ProtoReader.nextTag() encounters the unknown START_GROUP field and calls skipGroup(). Inside skipGroup(), the negative varint length is read without validation, stored in state, and forwarded through readData() to ReadBuffer.readData(count: -128). The upper-bound-only guard passes, and Foundation.Data(bytes: pointer, count: -128) triggers an unrecoverable SIGTRAP, terminating the process.
5. Achieve denial of service: The target process is killed by Signal 5 (SIGTRAP). The crash cannot be caught by the application's error handlers, resulting in a service outage (GitHub Advisory).

• Network: Repeated short (~10-byte) protobuf-encoded requests to endpoints that accept protobuf input; payloads containing the byte sequence 9B 06 0A 80 FF FF FF 0F 9C 06 or similar patterns with varint-encoded negative lengths inside group fields.
• Logs: Sudden process termination or crash reports in application logs with no preceding catchable error; absence of ProtoDecoder.Error log entries before the crash; crash reporters (e.g., Crashlytics, Sentry) showing SIGTRAP / Signal 5 originating from Data.init(bytes:count:) in Foundation.
• Process / Crash Reports: Stack traces showing the call chain: ProtoDecoder.decode(_:from:) → ProtoReader.nextTag(token:) → ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) → ProtoReader.readData() → ReadBuffer.readData(count:) → Data.init(bytes:count:) terminating with SIGTRAP at Data.InlineData.init(_:) in Foundation (GitHub Advisory).

Upgrade Wire's Swift runtime to version 6.4.1 (stable line) or 7.0.0-alpha04 (7.x alpha line), both of which include the fix from PR #3616. Swift Package Manager users should update their dependency declaration to .package(url: "https://github.com/square/wire.git", from: "6.4.1"). CocoaPods users should update the Wire pod to 6.4.1 or later. If an immediate upgrade is not feasible, reduce exposure by validating or filtering protobuf payloads before decoding, avoiding protobuf decoding on untrusted inputs, or rejecting group wire types at an outer protocol boundary — however, these are not complete substitutes for upgrading since the vulnerable path is schema-agnostic (GitHub Advisory, Wire 6.4.1 Release, Fix PR).

The vulnerability was reported by security researcher tonghuaroot and disclosed by the Wire/Square team via GitHub Security Advisory GHSA-86wm-r4c5-2rc9. The advisory explicitly notes this is the Swift sibling of a previously fixed Kotlin/JVM issue (CVE-2026-45799 / GHSA-7xpr-hc2w-34m9), highlighting that the earlier Kotlin fix did not cover the analogous Swift code path. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (GitHub Advisory).