Wire provides protocol buffer support for several platforms, and its Swift runtime includes a decoding function that can be sent a negative length for a LENGTH_DELIMITED field. When the decoder processes such a value, the length is forwarded to a Foundation routine that accepts the negative count and the process terminates unrecoverably. This results in a crash of any Swift process that decodes untrusted protocol buffer data, providing an attacker with an efficient denial‑of‑service vector. The flaw does not require authentication or user interaction, and the crash cannot be recovered through the normal error handling path.

The issue affects the Wire library distributed by Square under the product name Wire Swift runtime. All versions before 6.4.1 and before 7.0.0‑alpha04 are impacted, including prior releases used in gRPC implementations for Android, Kotlin, Swift, and Java. The flaw is not present in the patched releases 6.4.1 and 7.0.0‑alpha04 or later.

The CVSS score of 7.5 indicates a high severity, and although EPSS data is not available, the lack of authentication requirements and the ability to trigger a crash from any malformed input make this a practical denial‑of‑service risk. The vulnerability is not listed in CISA’s KEV catalog, but the lack of mitigation in the runtime means it remains exploitable in all affected deployments. An attacker can exploit this by sending protocol buffer messages with a negative length field to any service or application that uses the vulnerable Wire runtime to decode incoming data.