Bitcoin Core discloses five patched vulnerabilities, including a high-severity remote-crash bug that lingered for eight years

Bitcoin Core's security team has now publicly detailed five separate node vulnerabilities — one rated High — all fixed quietly in earlier releases and disclosed only after the vulnerable versions reached end of life.

The most serious, CVE-2024-52911, was disclosed on 2026-05-05 and rated High severity (Bitcoin Core). It is a use-after-free bug in the script interpreter present from version 0.14.0 (2017) until 29.0. During block validation, a background thread could read PrecomputedTransactionData after it was destroyed — a C++ object-destruction-ordering flaw triggered on an early return from an invalid block. Per the project, an attacker able to mine a block with sufficient proof-of-work could crash victim nodes; because of the nature of use-after-free bugs, remote code execution "is possible" but "unlikely" given constraints on the input data. Cory Fields (MIT DCI) reported it privately on 2024-11-02; Pieter Wuille pushed a covert fix into open PR #31112 four days later, merged 2024-12-03, and shipped in 29.0 on 2025-04-12.

The other four, all disclosed together on 2025-10-24 and all rated Low severity (Bitcoin Core):

• CVE-2025-46597 — an integer overflow crashing 32-bit nodes on blocks over 1GB, described by the project as "extremely hard to exploit" (needs a >3GB mempool on a machine with ≤4GiB RAM). Reported by Pieter Wuille; mitigated by Antoine Poinsot.
• CVE-2025-46598 — CPU exhaustion from crafted unconfirmed transactions taking seconds each to validate, usable to delay block propagation. Reported by Poinsot; mitigated by Wuille, Anthony Towns and Poinsot.
• CVE-2025-54604 and CVE-2025-54605 — two disk-filling bugs via unbounded logging of spoofed self-connections and of invalid blocks. Both reported by Niklas Goegge (in 2022) and fixed by log rate-limiting from Eugene Siegel and Goegge.

Key facts

• CVE-2024-52911: High severity, use-after-free, affects 0.14.0–pre-29.0; fixed in 29.0 (2025-04-12), disclosed 2026-05-05 (Bitcoin Core).
• CVE-2025-46597 / -46598 / -54604 / -54605: all Low severity, fixed in v30.0 (2025-10-10), disclosed 2025-10-24 (Bitcoin Core).
• All fixes were merged as "covert" patches before public disclosure (Bitcoin Core timelines).

The real-world read

Bitcoin Core's disclosure practice is the story here, and it's deliberate, not sloppy. The High-severity fix shipped in April 2025 but wasn't disclosed until May 2026 — after 28.x went end of life on 2026-04-19. Fixes are pushed as "covert" mitigations tucked into unrelated PRs (Wuille's #31112, Poinsot's #32530) so watchers can't reverse-engineer the bug before nodes upgrade. The upside: attackers stayed in the dark. The cost: node operators running the fix for a year weren't told what it was for, and the -52911 flaw sat exploitable for roughly eight years. Note also the timelines' honesty about their own limits — the RCE risk is flagged as "unlikely," the Low-severity bugs as barely exploitable, rather than hyped. Two of the disk-filling reports date to 2022, meaning some fixes took three years to land.

None of this is marketing material; these are primary security advisories from the project itself, and they read as such — dry, specific, no spin.

Opinion, and whose

Bitcoin Core assigns the severities (High for -52911, Low for the rest) and characterizes exploitability; those are the project's own assessments, not independent audits. No third party in these sources disputes them.

Sources

• Bitcoin Core security disclosures (bitcoincore.org), CVE-2024-52911, -2025-46597, -46598, -54604, -54605 — primary advisories providing all technical detail, severities, attributions and timelines. Not marketing.

This is news reporting, not financial or security advice; node operators should consult the official Bitcoin Core advisories and run a patched release.