The vulnerability arises from an integer underflow in the message length check for encrypted payloads shorter than 16 bytes. When a maliciously crafted Proteus external message is received, the application crashes automatically without user action, leading to a permanent crash loop that prevents the app from being reopened until the local state is wiped. The weakness is a classic integer underflow (CWE-191) and an unchecked user-supplied value (CWE-20).

The issue affects all installations of the Wire iOS client on versions prior to 4.16.0, including 4.15.x and earlier. The affected vendor is Wireapp, product Wire‑iOS.

The CVSS score of 6.5 classifies this as a moderate severity flaw. Since the device receives malicious content via a message that can be sent remotely, the attack vector is likely network, though no direct exploitation evidence is provided. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Because the crash is triggered immediately upon receipt and the message persists in the conversation, an attacker could disrupt service with a single message, but no user interaction is required beyond receiving the message.