CVE-2026-63126: Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wire protobuf readers (ByteArrayProtoReader32 / ProtoAdapter.decode)to a version that resolves this vulnerability.Fixed in 6.4.5 - Upgrade
Upgrade
Wire protobuf readers (ByteArrayProtoReader32 / ProtoAdapter.decode)to a version that resolves this vulnerability.Fixed in 7.0.0-alpha04
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using affected Wire protobuf readers are exposed when they decode protobuf bytes supplied by an attacker or another untrusted source. The affected paths include Kotlin byte-array and ByteString decoding, as well as related reader and size-delimited decoding paths.
What does an attacker need to exploit it?
An attacker only needs to provide malformed protobuf data with crafted length values to a vulnerable decoder. No authentication or user interaction is required.
What is the practical impact?
Malformed input can trigger unchecked exceptions, traps, out-of-bounds behavior, or excessive memory allocation, causing denial of service. No confidentiality, integrity, or code-execution impact is known.
Which versions contain the fix?
Upgrade to Wire 6.4.5 or 7.0.0-alpha04. Versions before those releases are affected according to the advisory.