Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

22 ℃

70%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 07:30:01

[USD] USD 80,221.72

[BRL] BRL 394,225.58 [USD] USD 80,221.72 [GBP] GBP 58,839.50 [EUR] EUR 68,050.80
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 07:33:37 up 231 days, 16:04, 4 users, load average: 0.00, 0.00, 0.00

[08/05/2026 21:20] STF cobra Senado e Presidência sobre derrubada de veto da dosimetria - CNN Brasil

[08/05/2026 20:44] Defesa de Jair Bolsonaro pede anulação da condenação no STF - Estado de Minas

[08/05/2026 21:40] Ex-presidente do BRB chega na Papudinha após decisão de Mendonça - Correio Braziliense

[08/05/2026 10:34] 'Pai do Lulinha': Flávio grava vídeo após operação da PF contra Ciro Nogueira e vincula caso Master ao PT - O Globo

[08/05/2026 18:30] VÍDEO: Suspeito entra em luta corporal com policial, tenta tomar fuzil e dispara 5 vezes - G1

[08/05/2026 13:46] Policial Civil é preso como autor de tiro que matou passageira de carro de aplicativo durante briga de trânsito no Pechincha - O Globo

[08/05/2026 20:11] Moradora de prédio atingido por avião em BH denuncia assédio - Estado de Minas

[08/05/2026 21:44] Ciclone bomba: satélite mostra avanço de "mancha" de chuva no Brasil - NSC Total

[08/05/2026 16:45] Trump respeita quem se mostra firme e altivo como Lula, diz ex-embaixador nos EUA - CartaCapital

[08/05/2026 20:57] Moradores alertavam sobre riscos em local de morte de criança na BR-262, em Sabará - Rádio Itatiaia

[CVE-2026-20968] [Modified: 15-01-2026] [Analyzed] [V3.1 S6.7:MEDIUM] Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attackers to execute arbitrary code.

[CVE-2026-20969] [Modified: 15-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege. User interaction is required for triggering this vulnerability.

[CVE-2026-20970] [Modified: 15-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Improper access control in SLocation prior to SMR Jan-2026 Release 1 allows local attackers to execute the privileged APIs.

[CVE-2026-20971] [Modified: 15-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Use After Free in PROCA driver prior to SMR Jan-2026 Release 1 allows local attackers to potentially execute arbitrary code.

[CVE-2026-20972] [Modified: 15-01-2026] [Analyzed] [V3.1 S3.3:LOW] Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.

[CVE-2026-20973] [Modified: 02-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory.

[CVE-2026-20974] [Modified: 02-02-2026] [Analyzed] [V3.1 S4.6:MEDIUM] Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock.

[CVE-2026-20975] [Modified: 15-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Improper handling of insufficient permission in Samsung Cloud prior to version 5.6.11 allows local attackers to access specific files in arbitrary path.

[CVE-2026-20976] [Modified: 15-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Improper input validation in Galaxy Store prior to version 4.6.02 allows local attacker to execute arbitrary script.

[CVE-2025-69194] [Modified: 05-03-2026] [Analyzed] [V3.1 S8.8:HIGH] A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.

[CVE-2025-69195] [Modified: 05-03-2026] [Analyzed] [V3.1 S7.6:HIGH] A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.

[CVE-2025-10569] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to create a denial of service condition by providing crafted responses to external API calls.

[CVE-2025-11246] [Modified: 22-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner associations.

[CVE-2025-13761] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.0:HIGH] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.

[CVE-2025-13772] [Modified: 22-01-2026] [Analyzed] [V3.1 S7.1:HIGH] GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.

[CVE-2025-13781] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations.

[CVE-2025-3950] [Modified: 21-01-2026] [Analyzed] [V3.1 S3.5:LOW] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak certain information by referencing specially crafted images that bypass asset proxy protection.

[CVE-2025-64090] [Modified: 12-02-2026] [Analyzed] [V3.1 S10.0:CRITICAL] This vulnerability allows authenticated attackers to execute commands via the hostname of the device.

[CVE-2025-64091] [Modified: 12-02-2026] [Analyzed] [V3.1 S8.6:HIGH] This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.

[CVE-2025-64092] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.5:HIGH] This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.