The vulnerability is in the skipGroup() methods of Wire’s proto runtime. The code does not check that a LENGTH_DELIMITED field length is non‑negative before calling skip(), so a crafted protobuf message that encodes the varint −128 as a signed int can make the internal read pointer move to a negative offset. When the next byte is read the runtime throws an ArrayIndexOutOfBoundsException instead of the expected IOException or ProtocolException, causing the process that is decoding the message to crash. This produces a denial‑of‑service condition for any service that uses ProtoAdapter.decode(byte[]) on untrusted input. This issue is fixed in versions 6.3.0 and 7.0.0‑alpha03.

The defect exists in square:wire before versions 6.3.0 and 7.0.0‑alpha03. All language bindings that rely on the wire‑runtime, including Android, Kotlin, Swift and Java, are affected until the library is upgraded to 6.3.0 or 7.0.0‑alpha03.

The CVSS score is 7.5, indicating a high severity. The EPSS score is below 1%, implying a low probability that the vulnerability is actively exploited today. The vulnerability is not listed in the CISA KEV catalog. The likely attack scenario involves an attacker delivering a malicious protobuf payload to a service that decodes messages with Wire; if the service runs on a trusted environment it can crash the process, but the vulnerability does not provide code execution. The absence of a negative‑length check is the single weakness that enables the crash.