Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

16 ℃

97%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 00:30:02

[USD] USD 79,127.36

[BRL] BRL 402,095.15 [USD] USD 79,127.36 [GBP] GBP 59,369.26 [EUR] EUR 68,081.18
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 00:41:03 up 238 days, 9:12, 3 users, load average: 0.01, 0.01, 0.00

[15/05/2026 22:59] Após negar, Eduardo confirma ter assinado contrato de gestão financeira de filme de Bolsonaro; entenda - BBC

[15/05/2026 20:30] STF determina prisão de Ricardo Magro, do Refit; empresário entra em lista da Interpol - ICL Notícias

[15/05/2026 17:04] Gilmar manda mensagem acusando Fachin de obstruir pauta do STF e amplia crise interna na Corte - O Globo

[15/05/2026 09:29] Lula chamou Magro de 'grande chefe do crime organizado' e disse ter pedido prisão a Trump - O Globo

[15/05/2026 17:30] Menina de 8 anos é atacada por onça-parda em trilha na Chapada dos Veadeiros, em Goiás - Folha de S.Paulo

[15/05/2026 14:22] Mãe denuncia estupro coletivo de menina de 12 anos na Zona Oeste do Rio; oito menores foram identificados pela polícia - Extra online

[15/05/2026 18:07] PGR denuncia ao STJ Romeu Zema por calúnia contra ministro Gilmar Mendes - G1

[15/05/2026 18:00] José Dirceu é diagnosticado com linfoma; entenda tratamento da doença - CNN Brasil

[15/05/2026 18:52] PEC do fim da escala 6x1 muda a Constituição, reduz jornada para 40 horas e prevê punição a empresas - Revista Oeste

[15/05/2026 17:41] Investigação de Lulinha: PF revela por que transferiu delegado que pediu quebra de sigilo - ND Mais

[CVE-2020-36926] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique identifiers.

[CVE-2020-36927] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe' to inject malicious executables and escalate privileges.

[CVE-2020-36928] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Brother\BRAgent\ to inject and execute malicious code with elevated system permissions.

[CVE-2020-36929] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted file paths in BrAuSvc and BRPA_Agent services to inject malicious executables and escalate privileges on the system.

[CVE-2020-36930] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\SysGauge Server\bin\sysgaus.exe' to inject malicious executables and escalate privileges.

[CVE-2021-47780] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the improperly configured service path to inject malicious executables that will be run with LocalSystem permissions during service startup.

[CVE-2021-47783] [Modified: 09-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.

[CVE-2021-47785] [Modified: 09-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. Attackers can craft a malicious payload to overwrite SEH handlers and execute a bind shell on port 3110 by exploiting improper input validation.

[CVE-2021-47786] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests. Attackers can send a crafted 2000-byte buffer with specific byte patterns to the REDRAGON_MOUSE device to crash the kernel driver.

[CVE-2021-47787] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious executables in specific unquoted path segments to potentially gain SYSTEM-level access by exploiting the service path configuration.

[CVE-2021-47788] [Modified: 30-01-2026] [Analyzed] [V3.1 S8.8:HIGH] WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.

[CVE-2021-47789] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending oversized input. Attackers can exploit the driver by sending a 2000-byte buffer through DeviceIoControl to trigger a kernel-level system crash.

[CVE-2021-47790] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Active WebCam 11.5 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the misconfigured service path by placing malicious executables in specific directory locations to gain administrative access.

[CVE-2021-47791] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.5:HIGH] SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulation. Attackers can trigger crashes by entering malformed paths, using invalid IP addresses, or clearing connection history in the client's interface.

[CVE-2021-47792] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Remote Mouse 4.002 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path in the RemoteMouseService to inject malicious executables and gain administrative access.

[CVE-2021-47793] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized message payload. Attackers can generate a 9 million byte buffer and paste it into the messaging interface to trigger an application crash.

[CVE-2021-47794] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.8:HIGH] ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host.

[CVE-2021-47805] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Disk Savvy 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries to inject malicious executables that will be run with elevated LocalSystem privileges.

[CVE-2021-47806] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Dup Scout 13.5.28 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Dup Scout Server\bin\dupscts.exe' to inject malicious executables and escalate privileges.

[CVE-2021-47807] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Sync Breeze 13.6.18 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries located in 'Program Files' directories to inject malicious executables and escalate privileges.