Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

21 ℃

67%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 11:00:02

[USD] USD 63,363.16

[BRL] BRL 326,421.66 [USD] USD 63,363.16 [GBP] GBP 47,879.04 [EUR] EUR 55,230.50
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 11:07:15 up 273 days, 19:38, 5 users, load average: 0.00, 0.03, 0.01

[20/06/2026 09:10] Governo aciona PF para investigar alerta extremo da Defesa Civil - Poder360

[19/06/2026 19:31] Vorcaro marcou encontro com Jaques Wagner e disponibilizou avião para senador, indicam diálogos - Estadão

[20/06/2026 06:19] STF: Por que caso Mariana Ferrer se tornou emblemático e será julgado de novo após decisão do Supremo - BBC

[19/06/2026 22:49] Previsão indica risco de neve em forte onda de frio que vem por aí - UOL Notícias

[19/06/2026 17:53] Trump chama Lula de 'muito volátil' e diz que 'não poderia se importar menos' com o brasileiro - O Globo

[20/06/2026 09:37] Trump volta a criticar Giorgia Meloni e diz que não quer melhorar relações - CNN Brasil

[19/06/2026 16:54] Lindbergh pede pela 2ª vez que Moraes revogue domiciliar de Bolsonaro - Poder360

[20/06/2026 00:00] Último dia do outono terá frio no Sul e no Sudeste e chuva forte em parte do Centro-Sul - G1

[20/06/2026 02:00] Morte em rope jump completa 1 semana: o que ainda falta saber sobre tragédia de jovem lançada sem cordas - G1

[19/06/2026 10:00] Analfabetismo no Brasil cai para 4,9% e atinge menor taxa de série histórica, diz IBGE - G1

[CVE-2025-52603] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

[CVE-2025-67438] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.

[CVE-2025-70831] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unauthenticated attacker to inject arbitrary operating system commands, leading to complete server compromise.

[CVE-2026-2846] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-2847] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument Isp_Name results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

[CVE-2025-15582] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-15583] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-70833] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

[CVE-2026-26093] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

[CVE-2026-26095] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26096] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26097] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26098] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26099] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26100] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26101] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26102] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26721] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.1:HIGH] An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.

[CVE-2026-26722] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality.

[CVE-2026-26723] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter.