CVE-2026-45799

Katalog CVE

CVSS 7.5 · High EPSS 0,73%

Kerentanan Improper Validation of Array Index pada squareup wire. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

12 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-129: Improper Validation of Array Index

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 52,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9 advisory vendor · exploit
• https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0 patch
• https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773 patch
• https://github.com/square/wire/pull/3595 issue tracking
• https://github.com/square/wire/pull/3597 issue tracking
• https://github.com/square/wire/releases/tag/6.3.0 release notes
• https://github.com/square/wire/releases/tag/7.0.0-alpha03 release notes