Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

13 ℃

93%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 01:00:02

[USD] USD 70,854.79

[BRL] BRL 357,136.47 [USD] USD 70,854.79 [GBP] GBP 52,653.96 [EUR] EUR 60,903.66
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 01:14:08 up 255 days, 9:45, 4 users, load average: 0.00, 0.00, 0.00

[01/06/2026 17:34] Produtora de ‘Dark Horse’ teve contrato de R$ 5 milhões com o DF na gestão Ibaneis - ICL Notícias

[01/06/2026 12:48] Ciro diz que EUA não invadirão Brasil: "Vão bloquear contas de facções" - Poder360

[01/06/2026 14:15] Colômbia: Candidato da esquerda volta atrás em acusação de irregularidades - CNN Brasil

[01/06/2026 13:51] Trump diz que Irã não informou EUA sobre suspensão das negociações - CNN Brasil

[01/06/2026 18:00] Pão de queijo, broa e camisa: Flávio Bolsonaro investe na mineiridade no Mercado Central - O TEMPO

[01/06/2026 15:06] TCE-RJ rejeita contas de Cláudio Castro de 2025 por 3 votos a 1 - O Globo

[01/06/2026 17:42] Caso Henry: ‘Lesão teria coagulado espontaneamente’, diz médico da defesa sobre laceração hepática apontada como causa da morte - O Globo

[01/06/2026 20:13] Corpo encontrado em Ilhabela é de homem desaparecido, diz Marinha - CNN Brasil

[01/06/2026 12:10] Menino mordido por tubarão em Piedade tem perna amputada, diz médico do HR - Folha PE

[01/06/2026 12:57] Passageira morre após cair de escada de avião no aeroporto de Congonhas, em SP - Jovem Pan

[CVE-2026-1736] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request of the file /src/sgwc/s11-handler.c of the component SGWC. Such manipulation leads to reachable assertion. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. A patch should be applied to remediate this issue. The issue report is flagged as already-fixed.

[CVE-2026-1737] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function sgwc_s5c_handle_create_bearer_request of the file /src/sgwc/s5c-handler.c of the component CreateBearerRequest Handler. Performing a manipulation results in reachable assertion. Remote exploitation of the attack is possible. The exploit is now public and may be used. To fix this issue, it is recommended to deploy a patch. The issue report is flagged as already-fixed.

[CVE-2026-1738] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A flaw has been found in Open5GS up to 2.7.6. The impacted element is the function sgwc_tunnel_add of the file /src/sgwc/context.c of the component SGWC. Executing a manipulation of the argument pdr can lead to reachable assertion. The attack can be executed remotely. The exploit has been published and may be used. It is advisable to implement a patch to correct this issue. The issue report is flagged as already-fixed.

[CVE-2026-1739] [Modified: 11-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability has been found in Free5GC pcf up to 1.4.1. This affects the function HandleCreateSmPolicyRequest of the file internal/sbi/processor/smpolicy.go. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is df535f5524314620715e842baf9723efbeb481a7. Applying a patch is the recommended action to fix this issue.

[CVE-2026-1740] [Modified: 29-04-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1741] [Modified: 10-03-2026] [Analyzed] [V3.1 S6.6:MEDIUM] A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1742] [Modified: 29-04-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A vulnerability was identified in EFM ipTIME A8004T 14.18.2. Affected by this vulnerability is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi of the component VPN Service. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1744] [Modified: 29-04-2026] [Analyzed] [V3.1 S2.4:LOW] A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

[CVE-2026-25200] [Modified: 10-03-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue affects MagicINFO 9 Server: less than 21.1090.1.

[CVE-2026-25201] [Modified: 10-03-2026] [Analyzed] [V3.1 S8.8:HIGH] An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue affects MagicINFO 9 Server: less than 21.1090.1.

[CVE-2026-25202] [Modified: 10-03-2026] [Analyzed] [V3.1 S9.8:CRITICAL] The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1.

[CVE-2026-1745] [Modified: 29-04-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability was determined in SourceCodester Medical Certificate Generator App 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

[CVE-2026-1746] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-20711] [Modified: 19-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords.

[CVE-2026-22881] [Modified: 19-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords.

[CVE-2026-22888] [Modified: 19-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.

[CVE-2026-20407] [Modified: 04-02-2026] [Analyzed] [V3.1 S9.3:CRITICAL] In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00464377; Issue ID: MSV-4905.

[CVE-2026-20408] [Modified: 04-02-2026] [Analyzed] [V3.1 S8.8:HIGH] In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758.

[CVE-2026-20409] [Modified: 04-02-2026] [Analyzed] [V3.1 S7.8:HIGH] In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10363246; Issue ID: MSV-5779.

[CVE-2026-20410] [Modified: 04-02-2026] [Analyzed] [V3.1 S6.7:MEDIUM] In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10362552; Issue ID: MSV-5760.