Back to overview

CVE-2026-45799

HIGH
7.5
CVSS 3.1
Description
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.

Metadata

CVE ID
CVE-2026-45799
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-13 08:19 UTC
Published
2026-07-17 19:49 UTC
Last updated
2026-07-17 19:49 UTC
Primary CWE
CWE-129
CWE-129: Improper Validation of Array Index
Vendor / Product
square / wire
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
square wire — < 6.3.0, >= 7.0.0-alpha01, < 7.0.0-alpha03
Weakness (CWE)
CWESourceDescription
CWE-129 cna CWE-129: Improper Validation of Array Index
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (7)
Back to overview