PT-2025-27812 · Wire · Wire

Published 2025-07-03 · Updated 2025-07-03 · CVE-2025-49846

Positive Technologies (AI Summary)

CVSS v4.0

4.1

Medium

Base vector

AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Wire iOS versions 3.111.1 through 3.124.1

Description: The issue concerns the logging of messages in clear text to the iOS system logs when they are visible in the view port. This occurs due to the canOpenUrl() function being called with an invalid URL object, resulting in iOS logging the contents to the system log. This behavior is not documented. The logs can only be accessed by someone with physical access to the unlocked device. An estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited.

Recommendations: For Wire iOS versions 3.111.1 through 3.124.1, update to version 3.124.1 or later to resolve the issue. As a temporary workaround, users can reset their iOS device to remove the offending logs.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-117

CWE-532

Related Identifiers

CVE-2025-49846

GHSA-PJ5P-96XX-HC7M

Affected Products

Wire

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49846.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-49846 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49846 · Vendor Advisory
• https://github.com/wireapp/wire-ios/commit/0cff0e4298d87c2c56de07f3fb18d3e8e5a68fa3 · Note
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-pj5p-96xx-hc7m · Note
• https://github.com/wireapp/wire-ios/releases/tag/appstore%2F3.124.1 · Note
• https://twitter.com/CVEnew/status/1940815284304007451 · Twitter Post