CVE-2020-27853

Published: Oct 27, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.

Affected (6)

Products: Wire: Wire, Wire Audio, Video, And Signaling, Wire Secure Messenger

Wire

3 products

Wire

Wire Audio, Video, And Signaling

Wire Secure Messenger

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Wire Wire	version < 3.21.2936
Wire Wire	version < 3.21.3959
Wire Wire	version < 3.21.3932
Wire Wire Audio, Video, And Signaling	5.3 ≤ version < 6.4
Wire Wire Secure Messenger	version < 3.49.918
Wire Wire Secure Messenger	version < 3.61