Wire is a communications platform offering encrypted messaging, voice, and video services through a client application, web interface, and server infrastructure that collectively form a moderately scoped but prominently deployed unified communications system. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, reflecting the sensitivity of authentication, authorization, and data-handling logic that underpins secure communications. The exposure recurs across the client, web application, and server components through weakness classes including cross-site scripting, information disclosure, format-string injection, and improper authorization—issues endemic to applications that must mediate between user input and sensitive protocol state. Defenders tracking Wire deployments should treat severity escalations in messaging and authentication paths as high-priority and ensure timely patching across client and infrastructure tiers. Live exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wire over time
Signals from CVEs in this vendor scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41193CRITICAL wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cau | Mar 1, 2022 | 9.8 | 32 | NO | NO |
CVE-2020-27853CRITICAL Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio | Oct 27, 2020 | 9.8 | 32 | NO | NO |
CVE-2021-41093CRITICAL Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue | Oct 4, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-21382CRITICAL Restund is an open source NAT traversal server. The restund TURN server can be instructed to open a relay to the loopback address range. This allows you to reach any other service | Jun 11, 2021 | 9.6 | 30 | NO | NO |
CVE-2021-41100CRITICAL Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of a user with only the | Oct 4, 2021 | 9.8 | 29 | NO | NO |
CVE-2022-31122HIGH Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain detail | Oct 18, 2022 | 8.1 | 26 | NO | NO |
CVE-2022-23610HIGH wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to by | Mar 16, 2022 | 8.1 | 26 | NO | NO |
CVE-2023-48221HIGH wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability | Nov 20, 2023 | 8.8 | 25 | NO | NO |
CVE-2021-41119HIGH Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collisi | Apr 13, 2022 | 7.5 | 25 | NO | NO |
CVE-2022-31009MEDIUM wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partially unusable by causi | Jun 23, 2022 | 6.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (29 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wire.
Media articles that mention a CVE ID that affects a product developed by Wire — matched by CVE ID, not by vendor name.