CVE-2026-35049 Overview
CVE-2026-35049 is an input validation vulnerability [CWE-20] in wire-ios, the iOS client for the Wire secure messaging application. Versions prior to 4.16.0 fail to verify the length of encrypted payloads in Proteus external messages. An attacker sending a crafted message with a payload shorter than 16 bytes triggers an automatic crash upon receipt. The malicious message persists in the conversation, forcing the app into a crash loop on each relaunch until the local state is wiped.
Critical Impact
Remote attackers with conversation access can render the Wire iOS client permanently unusable without any user interaction, requiring a full local state wipe to recover.
Affected Products
- Wire iOS client (wire-ios) versions prior to 4.16.0
- Distributed via the Apple App Store
- Fixed in version 4.16.0
Discovery Timeline
- 2026-06-02 - CVE-2026-35049 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-35049
Vulnerability Analysis
The vulnerability resides in the Proteus protocol message handler used by the Wire iOS client. Proteus is the end-to-end encryption protocol Wire uses for secure messaging. When the client receives an external message, it processes an encrypted payload that is expected to meet a minimum size of 16 bytes, corresponding to the block size of the underlying symmetric cipher.
The handler does not validate that the encrypted payload meets this minimum length before passing it to the decryption routine. A payload shorter than 16 bytes causes an unrecoverable error that terminates the application. Because Wire stores incoming messages locally before they are fully processed, the malicious message remains in the conversation database after the crash.
When the user reopens the application, the same message is processed again, triggering the same crash. This creates a persistent denial-of-service condition that cannot be cleared from within the application.
Root Cause
The root cause is a missing length check on the encrypted payload of inbound Proteus external messages. Input validation [CWE-20] requirements for the cipher block size were not enforced before decryption was attempted, allowing malformed input to propagate into a code path that assumes a minimum buffer length.
Attack Vector
An attacker who shares a conversation with the victim sends a crafted Proteus external message containing an encrypted payload shorter than 16 bytes. The attack requires no interaction from the victim. The message is delivered through Wire's standard messaging infrastructure and is processed automatically upon receipt. The persistent nature of the stored message extends the denial-of-service across application restarts.
No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-v6wg-c7qc-x66g for technical details.
Detection Methods for CVE-2026-35049
Indicators of Compromise
- Repeated crashes of the Wire iOS application immediately after launch
- iOS crash reports referencing the Proteus message processing stack on wire-ios versions below 4.16.0
- Users reporting an inability to reopen Wire without reinstalling or wiping local app state
- Receipt of an external message from an unexpected sender immediately preceding the first crash
Detection Strategies
- Inventory iOS devices running wire-ios and flag versions earlier than 4.16.0 through mobile device management (MDM) telemetry
- Correlate iOS crash diagnostics with Wire process termination events to identify potential exploitation
- Monitor help desk tickets for Wire crash-loop reports and treat clusters as a potential incident
Monitoring Recommendations
- Forward iOS crash logs from managed devices to a centralized log platform for review
- Track Wire client version distribution across the fleet and alert on outdated installations
- Establish a reporting channel so users can flag suspicious senders before wiping local state, preserving forensic artifacts
How to Mitigate CVE-2026-35049
Immediate Actions Required
- Update wire-ios to version 4.16.0 or later through the Apple App Store on all managed devices
- Push the update through MDM where available to enforce compliance
- For users currently in a crash loop, remove and reinstall the Wire application to wipe the malicious message from local state, then update to 4.16.0 before signing back in
- Review conversations for messages from unknown or untrusted senders that may have triggered the crash
Patch Information
Wire released version 4.16.0 of wire-ios, which introduces the missing length check on Proteus external message payloads. The fixed version is available via the Apple App Store. Full details are published in the Wire GitHub Security Advisory.
Workarounds
- No workarounds are available according to the vendor advisory; updating to 4.16.0 is the only remediation
- As an interim recovery step, reinstalling the application clears the persisted malicious message but does not prevent re-exploitation on vulnerable versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
