Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu pouco nublado

15 ℃

89%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 06:30:01

[USD] USD 62,862.67

[BRL] BRL 319,285.85 [USD] USD 62,862.67 [GBP] GBP 46,786.80 [EUR] EUR 54,093.64
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 06:35:35 up 257 days, 15:06, 5 users, load average: 0.00, 0.00, 0.00

[04/06/2026 02:06] Jairinho é condenado a 43 anos por morte de Henry Borel; Monique recebe perdão judicial por homicídio culposo - O Globo

[03/06/2026 11:39] Lula sobe o tom contra os EUA, chama Rubio de ‘frustrado’ e anuncia ida ao G7 - CartaCapital

[03/06/2026 18:00] Esquerda minimizou aproximação dos Bolsonaros com Trump, diz Janones - Poder360

[03/06/2026 17:20] Lula anuncia mais uma viagem internacional; entenda - Revista Oeste

[03/06/2026 10:07] Presidente da Febraban vê “mal-entendido” em questionamento ao Pix - Poder360

[03/06/2026 15:17] Daniel Vorcaro apresenta nova proposta de delação e cita Ciro Nogueira - Correio Braziliense

[03/06/2026 23:05] O argentino e a criança no trem em MG: 'Agrediram ele. Vão matá-lo na cela' - Estado de Minas

[03/06/2026 19:20] Governo muda discurso e vê aval de Trump em medidas contra Brasil - CNN Brasil

[03/06/2026 07:59] Anvisa suspende lote da água mineral Crystal após testes detectarem presença de bactéria - Extra online

[02/06/2026 18:27] PEC da escala 6x1 não irá diretamente para o Plenário do Senado, diz Davi — Senado Notícias - Senado Federal

[CVE-2026-20977] [Modified: 05-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning.

[CVE-2026-20978] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application.

[CVE-2026-20979] [Modified: 05-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege.

[CVE-2026-20980] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.

[CVE-2026-20981] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.6:MEDIUM] Improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1 allows privileged physical attacker to execute arbitrary command with system privilege.

[CVE-2026-20982] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.0:MEDIUM] Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege.

[CVE-2026-20983] [Modified: 05-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege.

[CVE-2026-20985] [Modified: 25-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability.

[CVE-2026-20986] [Modified: 25-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members.

[CVE-2025-59818] [Modified: 11-02-2026] [Analyzed] [V3.1 S10.0:CRITICAL] This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.

[CVE-2026-24735] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

[CVE-2026-1642] [Modified: 13-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

[CVE-2026-20730] [Modified: 13-02-2026] [Analyzed] [V3.1 S3.3:LOW] A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

[CVE-2026-20732] [Modified: 13-02-2026] [Analyzed] [V3.1 S3.1:LOW] A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

[CVE-2026-22548] [Modified: 13-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

[CVE-2025-70545] [Modified: 11-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The Common Gateway Interface (CGI) component improperly handles user-supplied input, allowing a remote, unauthenticated attacker to inject arbitrary JavaScript that is persistently stored and executed when the affected interface is accessed.

[CVE-2026-22549] [Modified: 13-02-2026] [Analyzed] [V3.1 S4.9:MEDIUM] A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

[CVE-2025-61917] [Modified: 18-02-2026] [Analyzed] [V3.1 S7.7:HIGH] n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers could contain residual data from within the same Node.js process (for example, data from prior requests, tasks, secrets, or tokens), resulting in potential information disclosure. This issue has been patched in version 1.114.3.

[CVE-2026-0662] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.

[CVE-2026-20098] [Modified: 10-03-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input validation in certain sections of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload arbitrary files to the affected system. The malicious files could overwrite system files that are processed by the root system account and allow arbitrary command execution with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of video operator.