The Wire iOS client before version 4.16.0 improperly validates the length of encrypted payloads in Proteus external messages. Specifically, if a message with an encrypted payload shorter than 16 bytes is received, the app crashes automatically. Since the malicious message persists in the conversation, the app repeatedly crashes on startup, effectively locking the user out until local state is cleared. This vulnerability is addressed by version 4.16.0, which introduces the necessary length check to prevent the crash.

The vulnerability causes a denial of service (DoS) condition by crashing the Wire iOS app automatically upon receiving a crafted message. The persistent malicious message leads to a crash loop on app relaunch, preventing normal use until the local state is wiped. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

Upgrade the Wire iOS client to version 4.16.0 or later, which includes the fix for this vulnerability by adding the missing length check. No workarounds are available. Users must update the app via the App Store to resolve the issue. Clearing local state is required to recover if already affected.