A medium-severity flaw involving TCP urgent data could exhaust memory on non-Linux machines, and patched versions are already out
Bitcoin Core has disclosed a bug that lets a malicious peer crash nodes running on Windows and macOS by flooding them into memory exhaustion. The fix is already available, which means the main remaining risk is the operator who never clicks update.
The flaw was one of three vulnerabilities disclosed on October 28, 2026. It carries a medium-severity rating and affects nodes on non-Linux operating systems.
How the crash works
An attacker connected as a peer sends TCP urgent data, also called out-of-band data. This is a networking feature that lets a sender flag certain bytes for special handling.
The problem sits in how software watches network connections. Bitcoin Core’s advisory points to differences between two socket monitoring mechanisms, select() and poll(). Those differences can be abused to cause unbounded memory growth on affected platforms.
The node keeps setting memory aside and never stops. Eventually it runs out, and the software crashes.
A crashed node is not stolen funds. It is, however, a node that has stopped doing its job of validating and relaying transactions until someone restarts it.
Two more bugs, and a notable absence of CVEs
The same October 28 disclosure covered two additional problems.
The first is a separate medium-severity issue involving slow memory growth tied to paused peers that predate BIP31, an older protocol standard.
The second is an undo-file overflow rated low severity. The advisory considers the risk small because the conditions needed to exploit it are impractical.
Fixes landed in Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1. Versions 31.2 and 32.1 went out a day early on October 27. The other two arrived on October 28, the same day as the disclosure.
No CVEs were assigned to any of the three issues. Previous Bitcoin Core disclosures had used CVE identifiers to classify vulnerabilities, so this marks a departure from past practice.
Found by a machine, checked by a human
The vulnerabilities surfaced through Project Loupe, a code scanning tool built by Elias Rohrer at Spiral. Gregory Sanders validated the findings.
The research context around the disclosure notes that software vulnerabilities can now be found easily using modern machine learning techniques. This cuts both ways: defenders can scan code faster than ever, and so can attackers.
Bitcoin Core’s response, according to the findings, is to speed up its patch rollout process for bugs that are likely to be rediscovered. The logic is simple: if a flaw is easy to find, the window between discovery and exploitation shrinks.
What this means for node operators
The practical advice is unglamorous: update. Anyone running Bitcoin Core on Windows or macOS should move to one of the patched releases for their branch.
Historically, a significant share of nodes run older versions of Bitcoin Core. Those nodes stay exposed regardless of how fast the developers ship fixes.
For exchanges and miners, the stakes are operational. A crashed node can interrupt transaction processing until it comes back online. For individuals, a home node that falls over is annoying, but it is not a direct threat to coins held in a wallet.
