PatchTheCVECVE-2021-29508: Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a de
CVE-2021-29508 is a critical-severity flaw (CVSS 9.1) affecting wire. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.6% (top 24%) |
| CISA exploited list | No |
| Weakness | CWE-502 |
| Published | 2021-05-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-29508?
wire: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-29508 being exploited?
CVE-2021-29508 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-29508 affect?
CVE-2021-29508 affects wire. Severity is critical (CVSS 9.1). Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving en
How urgent is CVE-2021-29508?
Priority 61/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-45799 HIGH 7.5 UPGRADE Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java
- CVE-2023-22737 MEDIUM 6.5 UPGRADE wire-server provides back end services for Wire, a team communication and collaboration platform
- CVE-2022-43673 MEDIUM 4.7 UPGRADE Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retri
- CVE-2022-31009 MEDIUM 5.7 UPGRADE wire-ios is an iOS client for the Wire secure messaging application
- CVE-2022-23625 MEDIUM 6.5 UPGRADE UPGRADE Wire-ios is a messaging application using the wire protocol on apple's ios platform