Insecure deserialization in Wire

published 2021-05-11 5 y ago modified 2026-06-17 4 mo ago also GHSA-hpw7-3vq3-mmv6 , EUVD-2021-1107

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits: 0; none known

Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019. This also applies to the fork of Wire.

Exploit prediction

1.58% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:N/I:P/A:P
GitHub	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
nuget	Wire	<=1.0.0	no fix listed

Affected products

AsynkronIT Wire

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

github.com /AsynkronIT/Wire/security/advisories/GHSA-hpw7-3vq3-mmv6
web, exploit, third-party-advisory
nuget.org /packages/Wire/
third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-29508
advisory
nuget.org /packages/Wire
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary