Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens dispersas

12 ℃

84%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 10:00:02

[USD] USD 80,852.32

[BRL] BRL 397,073.80 [USD] USD 80,852.32 [GBP] GBP 59,716.95 [EUR] EUR 68,821.25
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 10:20:03 up 234 days, 18:51, 3 users, load average: 0.00, 0.00, 0.00

[11/05/2026 23:18] Explosão em SP: Sabesp e Comgás vão pagar R$ 2 mil a cidadãos afetados - CNN Brasil

[11/05/2026 15:28] STF deve validar Lei da Dosimetria mesmo após suspensão por Moraes - CartaCapital

[12/05/2026 05:10] Em ano eleitoral, Nunes Marques no TSE anima o PL e acende alerta no PT - CNN Brasil

[12/05/2026 06:30] Internet sob domínio do crime: exploração ilegal de sinal já atinge 37 cidades do Rio em meio a disputa de traficantes e milicianos - Extra online

[11/05/2026 13:14] Kakay deixa defesa de Ciro Nogueira no caso Banco Master - Poder360

[12/05/2026 08:08] VÍDEO: No dia mais frio ano, geada cobre cidades de SC após madrugada com -7°C - ND Mais

[12/05/2026 08:18] PF mira contratos da Secretaria estadual de Agricultura, Pecuária e Abastecimento com suspeita de fraude de R$ 200 milhões - O Globo

[12/05/2026 07:42] Pesquisa mostra a disputa pela presidência entre os eleitores do Mato Grosso do Sul; veja os números - CartaCapital

[12/05/2026 06:01] Pressionado, Lula lança seu 4º plano para segurança pública - Poder360

[12/05/2026 07:43] PF mira facções e cumpre 71 mandados de prisão em 16 estados - Correio Braziliense

[CVE-2025-41077] [Modified: 29-01-2026] [Analyzed] [V3.1 S8.1:HIGH] IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data. This allows the user's email addresses to be modified and, subsequently, using the password recovery functionality to access the application by impersonating any user, including those with administrative permissions.

[CVE-2025-41078] [Modified: 29-01-2026] [Analyzed] [V3.1 S8.1:HIGH] Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.

[CVE-2025-65552] [Modified: 03-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement rolling codes, message authentication, or anti-replay protection, allowing an attacker within RF range to record valid alarm/control frames and replay them to trigger false alarms.

[CVE-2025-65553] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming detection or mitigations, creating a denial-of-service condition that may lead to undetected intrusions or failure to trigger safety alerts.

[CVE-2025-66939] [Modified: 22-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file

[CVE-2025-67813] [Modified: 20-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication

[CVE-2025-71063] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.2:HIGH] Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.

[CVE-2025-46066] [Modified: 21-01-2026] [Analyzed] [V3.1 S9.9:CRITICAL] An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges

[CVE-2025-46067] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.2:HIGH] An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file

[CVE-2025-46068] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.8:HIGH] An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism

[CVE-2025-46070] [Modified: 21-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component

[CVE-2025-63314] [Modified: 22-01-2026] [Analyzed] [V3.1 S10.0:CRITICAL] A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.

[CVE-2025-66689] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerability is caused by flawed logic in the is_dangerous_path() validation function that uses exact string matching against a blacklist of system directories. Attackers can bypass these restrictions by accessing subdirectories of blacklisted paths.

[CVE-2025-68622] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.

[CVE-2025-68276] [Modified: 16-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

[CVE-2025-68468] [Modified: 16-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.

[CVE-2025-68471] [Modified: 16-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.

[CVE-2025-68656] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descriptor() frees and reallocates hid_device->ctrl_xfer when an oversized descriptor is requested but continues to use the stale local pointer, leading to an immediate use-after-free when processing attacker-controlled Report Descriptor lengths. This vulnerability is fixed in 1.1.0.

[CVE-2025-68657] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.

[CVE-2026-22033] [Modified: 27-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their custom_hotkeys) can inject JavaScript code that executes in other users’ browsers when those users load any page using the templates/base.html template. Because the application exposes an API token endpoint (/api/current-user/token) to the browser and lacks robust CSRF protection on some API endpoints, the injected script may fetch the victim’s API token or call token reset endpoints — enabling full account takeover and unauthorized API access.