Bitcoin Core fixes critical severity memory vulnerability, some nodes still use affected software

Foresight News reported, according to The Block, that Bitcoin Core quietly fixed its first-ever memory safety vulnerability in history before it was publicly disclosed. This high-severity use-after-free vulnerability could have allowed miners to remotely crash and execute code on other nodes. The vulnerability affected all Bitcoin Core versions from 0.14.0 to 28.x and was fixed in Bitcoin Core v29.0 in April 2025. However, it is estimated that about 43% of nodes may still be running pre-v29 affected software.

Cory Fields from the MIT Digital Currency Initiative discovered the vulnerability on November 2, 2024, and privately reported it to the development team. Four days later, Bitcoin Core developer Pieter Wuille released a stealth fix titled "Improve parallel script validation error debug logging" to avoid drawing the attention of potential attackers. This fix was merged in December 2024 and released in Bitcoin Core v29.0 in April 2025. The last affected version, 28.x, ended support on April 19, 2026, paving the way for public disclosure.