CVE-2022-31009

    Dashboard / Vulnerabilities / CVE-2022-31009

    CVE-2022-31009

    Published: 23 Jun 2022Last Modified: 12 Aug 2026

    Summary: DoS vulnerability: Invalid Accent Colors

    Details: wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partially unusable by causing it to crash multiple times on launch. These invalid accent colors can be used by and sent between Wire users. The root cause was an unnecessary assert statement when converting an integer value into the corresponding enum value, causing an exception instead of a fallback to a default value. This issue is fixed in [wire-ios](https://github.com/wireapp/wire-ios/commit/caa0e27dbe51f9edfda8c7a9f017d93b8cfddefb) and in Wire for iOS 3.100. There is no workaround available, but users may use other Wire clients (such as the [web app](https://app.wire.com)) to continue using Wire, or upgrade their client.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31009.json, https://github.com/wireapp/wire-ios/security/advisories/GHSA-83m6-p7x5-925j, https://nvd.nist.gov/vuln/detail/CVE-2022-31009, https://github.com/wireapp/wire-ios/commit/caa0e27dbe51f9edfda8c7a9f017d93b8cfddefb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -caa0e27dbe51f9edfda8c7a9f017d93b8cfddefb

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31009 | CVE-DB