Bitcoin Core Addresses Security Flaw Allowing Node Crashes on Windows and macOS

Bitcoin Core has disclosed a significant bug that allows malicious peers to crash nodes running on Windows and macOS by exploiting memory exhaustion. The vulnerability, along with two others, was made public on October 28, 2026, and has been rated as medium severity.

Details of the Vulnerability

The flaw enables an attacker connected as a peer to send TCP urgent data, which can lead to unbounded memory growth on affected platforms. This occurs due to differences in how network connections are monitored, specifically between the select() and poll() mechanisms. As a result, the node's memory usage continues to increase until it ultimately crashes.

Additional Vulnerabilities

Alongside the primary issue, two other vulnerabilities were identified. One involves slow memory growth from paused peers, while the other concerns an undo-file overflow, rated as low severity. The advisory notes that the risk from these issues is minimal due to impractical exploitation conditions.

Response and Recommendations

Bitcoin Core has rolled out patches in versions 29.5, 30.4, 31.2, and 32.1. Node operators are strongly advised to update their software promptly, as many nodes historically run outdated versions, leaving them vulnerable. A crashed node, while not a direct threat to funds, can disrupt transaction validation and relaying.

Impact of AI on Security Disclosures

The vulnerabilities were discovered through Project Loupe, an AI-powered code scanning tool. This marks a shift in Bitcoin Core's security disclosure policy, as the project now aims to accelerate vulnerability disclosures in response to the increasing ease of discovering software weaknesses through AI. This change emphasizes the need for rapid updates to maintain network security.