Critical
Security advisory
wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-41193
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:37 UTC · Revision 1
Source evidence
wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.
osv:CVE-2021-41193
Complete source record
{
"id": "54d29684eb9eccf4b360eb43f21a84218ce724dbe52afe22599c3fa0b9b3a5d1",
"url": "https://osv.dev/vulnerability/CVE-2021-41193",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-41193",
"summary": "wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.",
"evidence": "osv:CVE-2021-41193",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2021-41193",
"aliases": [
"CVE-2021-41193",
"GHSA-2j6v-xpf3-xvrv"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wireapp/wire-avs",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "40d373ede795443ae6f2f756e9fb1f4f4ae90bbe"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "40d373ede795443ae6f2f756e9fb1f4f4ae90bbe"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"7.1.78",
"7.1.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41193.json",
"vanir_signatures": [
{
"id": "CVE-2021-41193-023fad85",
"digest": {
"length": 1375,
"function_hash": "137192418844580695232203222931864098962"
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/ecall/ecall.c",
"function": "ecall_answer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-2beb9a20",
"digest": {
"length": 764,
"function_hash": "24315972786898140586360653136531191894"
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "tools/zcall/conv.c",
"function": "prekey_handler"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-33ad14a9",
"digest": {
"length": 4895,
"function_hash": "320698680746276354696034802618915934031"
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/econn_fmt/msg.c",
"function": "econn_message_encode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-3e08a36d",
"digest": {
"length": 865,
"function_hash": "144152013152982634885956760311987979503"
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/wcall/wcall.c",
"function": "wcall_i_answer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-4b99adc9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"308624077975138330305980355135051724752",
"102921489119434680181053842077983939790",
"232578541595857406169280995524764846687",
"169823251108584365261735495116541368441"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/peerflow/cbr_detector_remote.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-724eb0a4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"76653670442340488770268255021394299804",
"261637742221656249659485626098520132147",
"63438764266900706973261477816645184358",
"87400939391163736108881603582380780132",
"265807211849001142434965172916976464570"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/wcall/wcall.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-82225d52",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113487670118309184669552254124830804008",
"170438342334713069984096235704896617028",
"73709414786598779145235145864558617980",
"130653114588022281566620050770639861358",
"18467783005951437045776103770656012492",
"75165810683094715222491790795063826765",
"206981051519041685482421267889150226718"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "tools/zcall/conv.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-85ed6c0b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"186340558399333889654924600646301796960",
"120628511118891014196263566163865099135",
"281749825300478165739799238199876080896",
"165205835087166637958136290861610627046",
"333001746743666767677133685736926783703",
"218442677332708184268375683424110623654",
"21141695771634799613731390584175946480",
"91149340451645566441072484802055595117",
"48792234082637137688481367434233162476",
"339516048942337254181500642068987593021"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/econn_fmt/msg.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-9119a1b3",
"digest": {
"length": 705,
"function_hash": "118161913871746784050225022069835376665"
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/peerflow/cbr_detector_remote.cpp",
"function": "CbrDetectorRemote::Decrypt"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-91a6a95f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"158677121935445971789156979952201099275",
"97332125857358333262307768622564929492",
"257224481685818778197085018295352004349",
"48443932394836285049559073073291644125",
"178239383745926058888384005460537077574",
"108444253164832808119709556558616351237",
"328038853584671082032054880307157033205",
"103187638296723866622578408729475821779"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/ecall/ecall.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-c837f511",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316677457568381156317227419810086070469",
"313439772446894177064763355340166273584",
"245963326050631969303911716312283956611",
"13300082453546751145680853521723499373",
"166655948322390501507991567854270981291"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "test/test_acm.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-d0f8ec8e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74437101819328013992691209772526868360",
"308238029360543500096343200510899953785",
"148835190815470738018058723597174662988",
"13082877180414490015330616542686516209",
"235046777809188866100711934764635942214",
"163200135364466883412191084307063096208",
"40709715735382444479180603582686842197",
"12417713006095376225189919444479888769",
"199297838489740147095174018587694132093",
"217456120509454111746231852334735761927",
"179115158689524685285587964341529855773",
"14377113664085028464825860960116482776",
"51311434706522271500143940835289027843",
"46841283949146643704149687851203931638",
"170784696549027926337078627113375115647",
"259848475038035640115446525895156143271",
"153982462690132316094715657078653569562",
"302768016282426143521260972330918731307",
"86287206544613414097369128738959195711",
"96423252348272965955214095955002905022",
"56077492942308253378601444849558425763"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/peerflow/cbr_detector_remote.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-d75f1723",
"digest": {
"length": 1588,
"function_hash": "100182733158711948882661214708149727218"
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/ecall/ecall.c",
"function": "ecall_start"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-dcaf940b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"4595171499761176964061990825181205327",
"292862079742337240317191311060548865537",
"155736461442113157646584069689821686578",
"223313662224011515394702060578107903514",
"31526665477508512708676428048792819793"
]
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/audio_level/audio_level.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-41193-e360637b",
"digest": {
"length": 1422,
"function_hash": "47775596749721570676920119300882167889"
},
"source": "https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"target": {
"file": "src/audio_level/audio_level.c",
"function": "audio_level_json"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:06:39Z"
}
}
],
"modified": "2026-10-20T14:06:39.707982695Z",
"provider": "osv",
"references": [
"https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe",
"https://github.com/wireapp/wire-avs/security/advisories/GHSA-2j6v-xpf3-xvrv"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:wire:wire-audio_video_signaling:*:*:*:*:*:*:*:*"
],
"vendor_product": "wire:wire-audio_video_signaling",
"extracted_events": [
{
"range": [
{
"fixed": "7.1.12"
}
],
"source": "CPE_RANGE"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "7.1.12"
}
],
"source": "DESCRIPTION"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-41193",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388558,
"published_at": "2022-03-01T19:15:08.403+00:00"
}