The Wire library's protobuf readers fail to consistently validate length fields controlled by attackers before advancing internal cursors and buffers. In Kotlin, the ProtoAdapter.decode methods use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can cause integer overflow, wrapping the position plus length to a negative limit and bypassing negative-length checks. Similar issues exist in related ProtoReader and ReadBuffer methods, allowing crossing of logical message boundaries and unsafe memory operations. An attacker supplying malformed protobuf bytes can trigger unchecked exceptions, out-of-bounds memory access, or excessive allocations, resulting in denial of service. The vulnerability affects versions prior to 6.4.5 and from 7.0.0-alpha01 up to but not including 7.0.0-alpha04. The issue is resolved in 6.4.5 and 7.0.0-alpha04.

Exploitation of this vulnerability can cause denial of service through application crashes or excessive memory consumption due to unchecked exceptions and out-of-bounds memory operations. There is no known impact on confidentiality, integrity, or remote code execution.

Upgrade to Wire library version 6.4.5 or later, or to 7.0.0-alpha04 or later. These versions include fixes that properly validate length fields and prevent integer overflow conditions. No other mitigations are indicated.