DEVOURED
Bitcoin Core's first memory safety bug in 15 years let miners execute code on other people's nodes, and 43% of the network is still vulnerable six months after the patch.
What: Cory Fields discovered CVE-2024-52911, a use-after-free memory bug affecting Bitcoin Core versions 0.14.1 through 28.4. Miners could crash nodes or execute remote code by mining specially crafted invalid blocks. Pieter Wuille quietly patched it via PR 31112 in December 2024, shipped in Bitcoin Core 29.0 in April 2025. Public disclosure came May 5, 2026, with 43% of nodes still running vulnerable software.
Why it matters: Bitcoin Core's 15-year run without memory safety issues is exceptional for a C++ codebase, but the 43% laggard rate shows voluntary upgrade models struggle to close security windows even when money is at stake.
Takeaway: If you run a Bitcoin full node on software older than v29, upgrade immediately to patch CVE-2024-52911.
Decoder
- use-after-free: Memory corruption bug where code reads memory after it's been freed, potentially letting attackers control the data the program accesses and execute arbitrary code.
- coinbase reward: The newly minted bitcoin awarded to a miner for successfully mining a valid block, currently 3.125 BTC per block after the 2024 halving.
Original article
Bitcoin Core developers disclosed CVE-2024-52911, a high-severity use-after-free memory vulnerability affecting versions 0.14.1 through 28.4.
Explore all 73 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi