Bitcoin Core disclosed a medium-severity bug that lets a malicious peer crash nodes on Windows and macOS through memory exhaustion. Patched versions are already out, so the main remaining risk is operators who do not update.
Bitcoin Core has disclosed a bug that lets a malicious peer crash a node running on Windows or macOS by flooding it until its memory runs out. The flaw was one of three vulnerabilities disclosed on October 28, 2026, and it carries a medium-severity rating.
How the crash works
An attacker connected as a peer sends TCP urgent data, also called out-of-band data, which lets a sender flag certain bytes for special handling. The advisory points to differences between two socket monitoring mechanisms, select() and poll(), that can be abused to cause unbounded memory growth on affected platforms.
The node keeps setting memory aside until it runs out, and then the software crashes. A crashed node does not mean stolen funds, but it stops validating and relaying transactions until someone restarts it.
Two more bugs and no CVEs
The same disclosure covered two other problems. The first is a medium-severity issue involving slow memory growth tied to paused peers that predate BIP31, an older protocol standard. The second is an undo-file overflow rated low severity, and the advisory considers the risk small because the conditions needed to exploit it are impractical.
Fixes landed in Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1. Versions 31.2 and 32.1 went out a day early on October 27, while the other two arrived on October 28.
No CVEs were assigned to any of the three issues. Previous Bitcoin Core disclosures had used CVE identifiers, so this marks a departure from past practice.
Found by a scanning tool, checked by a human
The vulnerabilities surfaced through Project Loupe, a code scanning tool built by Elias Rohrer at Spiral. Gregory Sanders validated the findings.
Bitcoin Core's response, according to the findings, is to speed up its patch rollout for bugs that are likely to be rediscovered. Anyone running Bitcoin Core on Windows or macOS should move to one of the patched releases for their branch.
Source: Crypto Briefing
Trading involves risk.
Risk Disclaimer
