CVE-2026-45799 Details
Description
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.
A vulnerability exists in the Wire library's gRPC and protocol buffers implementation for Android, Kotlin, Swift, and Java, prior to versions 6.3.0 and 7.0.0-alpha03. The issue arises in the 'skipGroup()' method of 'ByteArrayProtoReader32' and 'ProtoReader' classes within the 'wire-runtime' module. The vulnerability allows a crafted protobuf varint encoding to exploit the absence of validation for LENGTH_DELIMITED field lengths, leading to a negative internal position. This misalignment causes subsequent byte reads to throw an ArrayIndexOutOfBoundsException, bypassing the expected IOException or ProtocolException, and potentially crashing services that decode untrusted protobuf payloads.
Users should upgrade to Wire version 6.3.0 or later. For Wire 7 alpha users, the fix is included in the latest alpha release.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| squareup wire | < 6.3.0 7.0.0 alpha01 7.0.0 alpha02 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |