Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

25 ℃

48%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 14:00:02

[USD] USD 62,118.24

[BRL] BRL 322,443.35 [USD] USD 62,118.24 [GBP] GBP 46,391.20 [EUR] EUR 53,764.76
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 14:23:13 up 263 days, 22:54, 5 users, load average: 0.00, 0.01, 0.00

[10/06/2026 13:11] Genial/Quaest: Lula abre vantagem de seis pontos contra Flávio Bolsonaro no segundo turno - Valor Econômico

[10/06/2026 09:17] Nikolas, ao defender maioridade penal: ‘Cometeu crime, tem que ir para a cadeia’ - Revista Oeste

[09/06/2026 23:24] Ministra do TSE pede vista e adia julgamento sobre pesquisa da AtlasIntel - Poder360

[09/06/2026 23:11] Irã atinge base militar dos EUA na Jordânia, diz mídia iraniana - CNN Brasil

[10/06/2026 10:27] CCJ do Senado aprova PEC da autonomia financeira do Banco Central e inclui proteção ao Pix na Constituição - Brasil 247

[10/06/2026 07:05] Aprovação do governo Lula sobe e empata com desaprovação, aponta pesquisa Quaest - Brasil 247

[10/06/2026 06:54] Polícia Civil do RJ faz megaoperação contra o TCP no Complexo da Maré - CNN Brasil

[10/06/2026 09:58] Governo do RJ corta escolta da ex-primeira-dama e filhos de Cláudio Castro após decisão da Justiça - G1

[10/06/2026 03:01] Lula lidera reunião do Conselhão e deve pedir ajuda contra tarifaço dos EUA - CNN Brasil

[10/06/2026 11:32] Quem era influenciadora do agro morta a tiros dentro de casa em MG - CNN Brasil

[CVE-2025-15571] [Modified: 29-04-2026] [Analyzed] [V3.1 S3.3:LOW] A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-15572] [Modified: 29-04-2026] [Analyzed] [V3.1 S3.3:LOW] A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Unfortunately, the project has no active maintainer at the moment.

[CVE-2025-52436] [Modified: 18-02-2026] [Analyzed] [V3.1 S8.8:HIGH] An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests.

[CVE-2025-62676] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.1:HIGH] An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, FortiClientWindows 7.2.0 through 7.2.12, FortiClientWindows 7.0 all versions may allow a local low-privilege attacker to perform an arbitrary file write with elevated permissions via crafted named pipe messages.

[CVE-2025-68686] [Modified: 12-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

[CVE-2026-1602] [Modified: 12-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.

[CVE-2026-1603] [Modified: 10-03-2026] [Analyzed] [V3.1 S8.6:HIGH] An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

[CVE-2026-21743] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.

[CVE-2026-22153] [Modified: 12-02-2026] [Analyzed] [V3.1 S8.1:HIGH] An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way.

[CVE-2025-24851] [Modified: 17-03-2026] [Analyzed] [V3.1 S6.0:MEDIUM] Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

[CVE-2025-27243] [Modified: 17-03-2026] [Analyzed] [V3.1 S6.0:MEDIUM] Out-of-bounds write in the firmware for some Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

[CVE-2025-27535] [Modified: 17-03-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Exposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C. before version NVM ver. 3.84 within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

[CVE-2025-32003] [Modified: 17-03-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Out-of-bounds read in the firmware for some 100GbE Intel(R) Ethernet Network Adapter E810 before version cvl fw 1.7.6, cpk 1.3.7 within Ring 0: Bare Metal OS may allow a denial of service. Network adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

[CVE-2025-32092] [Modified: 20-04-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

[CVE-2025-32453] [Modified: 20-04-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Incorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

[CVE-2025-32739] [Modified: 20-04-2026] [Analyzed] [V3.1 S2.8:LOW] Improper conditions check in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

[CVE-2026-24885] [Modified: 13-02-2026] [Analyzed] [V3.1 S5.7:MEDIUM] Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50.

[CVE-2026-25530] [Modified: 13-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.

[CVE-2026-0652] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.8:HIGH] On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.

[CVE-2026-1996] [Modified: 24-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.