CVE-2026-63126 Overview
CVE-2026-63126 affects Wire, Square's gRPC and protocol buffers library for Android, Kotlin, Swift, and Java. Wire protobuf readers fail to consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, or allocations. A positive oversized length can wrap pos + length to a negative limit, escaping the existing negative-length check. Attackers can supply malformed protobuf bytes to trigger unchecked exceptions, out-of-bounds behavior, or excessive allocation. The vulnerability is fixed in versions 6.4.5 and 7.0.0-alpha04.
Critical Impact
Remote attackers can send malformed protobuf messages over the network without authentication to crash applications or exhaust memory, causing denial of service. No confidentiality, integrity, or code-execution impact is known.
Affected Products
- Square Wire (Kotlin, Java, Android) versions prior to 6.4.5
- Square Wire (Swift) versions prior to 7.0.0-alpha04
- Applications embedding ProtoAdapter, ProtoReader, ReadBuffer, or ProtoDecoder from vulnerable Wire releases
Discovery Timeline
- 2026-09-16 - CVE-2026-63126 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-63126
Vulnerability Analysis
The flaw is an integer overflow classified as [CWE-190]. Wire protobuf readers advance internal state based on lengths decoded from untrusted input. Multiple code paths — including ProtoAdapter.decode(ByteArray), ProtoAdapter.decode(ByteString), ByteArrayProtoReader32.internalNextLengthDelimited(), ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), and ProtoDecoder.decodeSizeDelimited(_:from:) — perform arithmetic on attacker-controlled length fields before verifying that the requested bytes exist within the current logical message boundary.
A positive but oversized length can cause pos + length to wrap into a negative value. The existing negative-length guard is bypassed, and subsequent operations cross message boundaries, perform unsafe pointer arithmetic, reserve excessive capacity, or convert unrepresentable sizes. The result is unchecked exceptions, memory traps, out-of-bounds reads, or unbounded allocation.
Root Cause
Wire reader paths trust decoded length-delimited field sizes before validating them against the remaining buffer. In the Swift runtime, Int(exactly:) conversion and boundary verification were missing before allocation and pointer advancement. In the Kotlin runtime, ByteArrayProtoReader32.internalNextLengthDelimited() computed a new limit without detecting integer wrap on 32-bit arithmetic.
Attack Vector
Any service or client that deserializes protobuf messages using Wire is reachable over the network without authentication or user interaction. An attacker crafts a message with a length varint whose value causes overflow when added to the current cursor position. The malformed message is delivered through any transport that uses Wire, including gRPC endpoints, message queues, or file inputs.
// Patch to wire-runtime-swift/src/main/swift/ProtoCodable/ProtoDecoder.swift
// Source: https://github.com/square/wire/commit/082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f
while fullBuffer.isDataRemaining {
let size = try fullBuffer.readVarint()
if size == 0 { break }
guard let size = Int(exactly: size) else {
throw ProtoDecoder.Error.unexpectedEndOfData
}
try fullBuffer.verifyAdditional(count: size)
let messageBuffer = ReadBuffer(
storage: fullBuffer.pointer,
count: size
)
The fix removes the permissive try? on readVarint(), rejects sizes that cannot be represented as Int, and calls verifyAdditional(count:) to confirm the requested bytes exist before allocation. The companion patch to ProtoReader.swift replaces raw pointer advancement with a bounded buffer.endPointer(count: length) call. See GitHub Pull Request #3635 for full details.
Detection Methods for CVE-2026-63126
Indicators of Compromise
- Repeated application crashes or unhandled exceptions originating from ProtoReader, ProtoAdapter, or ProtoDecoder stack frames
- Sudden JVM OutOfMemoryError or Swift runtime traps in services that consume protobuf input
- Abnormally large length-delimited fields in captured gRPC or protobuf traffic
Detection Strategies
- Inventory application dependencies for com.squareup.wire:wire-runtime and Swift Wire modules below the fixed versions
- Instrument protobuf-consuming endpoints to log deserialization exceptions with request source metadata
- Deploy fuzz testing against protobuf endpoints using length-boundary and varint-overflow test vectors
Monitoring Recommendations
- Alert on spikes in process restarts or crash-loop backoff for gRPC services
- Monitor heap usage and allocation rate on services that parse untrusted protobuf payloads
- Correlate anomalous inbound message sizes with downstream service errors in the SIEM
How to Mitigate CVE-2026-63126
Immediate Actions Required
- Upgrade Wire to 6.4.5 for Kotlin, Java, and Android consumers
- Upgrade Wire Swift to 7.0.0-alpha04 for iOS and macOS consumers
- Audit transitive dependencies to ensure no shaded or vendored copies of vulnerable Wire code remain
Patch Information
The maintainers released fixes in GitHub Release v6.4.5 and GitHub Release v7.0.0-alpha04. The patches are documented in GitHub Security Advisory GHSA-9rm7-3qhh-h2mc and landed via commits 082d5d8 and 25ebcab.
Workarounds
- Enforce a strict maximum message size at the transport layer (for example, gRPC maxInboundMessageSize) to bound allocation before Wire parses input
- Terminate protobuf traffic behind a proxy that validates message length fields before forwarding
- Isolate protobuf parsing in a sandboxed worker process with memory limits and automatic restart
# Gradle dependency pin for Kotlin/Java/Android consumers
./gradlew dependencies | grep wire-runtime
./gradlew --write-locks
# Update build.gradle.kts:
# implementation("com.squareup.wire:wire-runtime:6.4.5")
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
