--- title: "Bitcoin Core Patches Three Vulnerabilities Discovered by AI Scans" description: "Fixes address memory exhaustion and file overflow risks, affecting Windows, macOS, and BSD systems." url: https://basisdesk.news/analysis/bitcoin-core-patches-three-vulnerabilities-ai-scans published: 2026-10-29T14:01:21.159Z modified: 2026-10-29T14:01:21.159Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: neutral tickers: [BTC] tags: [Bitcoin Core, Vulnerabilities, Patches, Node Operations] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Bitcoin Core Patches Three Vulnerabilities Discovered by AI Scans Fixes address memory exhaustion and file overflow risks, affecting Windows, macOS, and BSD systems. ## At a glance - **What happened:** Bitcoin Core released patches on Oct. 27 and Oct. 28 to fix three vulnerabilities discovered by automated AI scans. - **Why it matters:** The vulnerabilities could have allowed malicious peers to crash nodes or exhaust memory on specific operating systems. - **Who is affected:** Bitcoin Core node operators, particularly those using Windows, macOS, BSD, 32-bit systems, and FAT32 filesystems. - **What's next:** No next step announced - **Primary source:** [Undo file overflow under extreme conditions](https://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/) — Bitcoin Core ## Key points - Bitcoin Core fixed a medium-severity bug allowing memory exhaustion via TCP urgent data on non-Linux systems. - A second medium-severity patch resolved unbounded memory growth related to paused pre-BIP31 peers. - A low-severity file overflow vulnerability was addressed, though 32-bit and FAT32 systems remain affected. ## Editorial remark - **Context:** The vulnerabilities were discovered through Project Loupe's automated LLM scans, highlighting the growing role of AI in identifying network security risks. - **Impact:** Node operators running Windows, macOS, and BSD systems are primarily affected by the TCP urgent data bug. All operators are impacted by the pre-BIP31 peer memory issue. - **Watch:** Monitor for potential exploits targeting unpatched nodes, particularly on 32-bit systems and FAT32 filesystems, which remain vulnerable to the file overflow issue. Bitcoin Core has released patches for three vulnerabilities discovered through automated large language model (LLM) scans [1][2][3]. The vulnerabilities, identified by Elias Rohrer's Project Loupe at Spiral and surfaced by Gregory Sanders, range from medium-severity memory growth bugs to a low-severity file overflow issue [1][2][3]. Fixes were deployed across Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1 on Oct. 27 and Oct. 28 [1][2][3]. ## TCP Urgent Data Memory Exhaustion The most critical of the three, rated medium severity, involves unbounded memory growth on non-Linux platforms [2]. A malicious peer could exploit this by sending TCP urgent (out-of-band) data to a node [2]. Bitcoin Core utilizes the `select()` backend to monitor socket events on Windows, macOS, and BSD, distinguishing it from Linux's `poll()` [2]. The `select()` code path monitored for exceptional conditions even when reads were paused to limit queued data [2]. Triggering this event prompted a read, bypassing backpressure limits and queuing unbounded data [2]. This vulnerability allowed malicious peers to trivially crash affected nodes [2]. ## Unbounded Memory Growth on Paused Pre-BIP31 Peers A second medium-severity issue addressed unbounded memory growth related to peers that do not support BIP31 [3]. Bitcoin Core queues announcements, including frequent transaction INVs, for all peers, even those marked as paused due to slow reading [3]. Normally, peers failing to respond to a ping within 20 minutes are disconnected, but this protocol excludes peers lacking BIP31 support [3]. Malicious actors could exploit this by simulating non-support for BIP31 and delaying message reading, causing the queue to grow infinitely [3]. Memory usage could expand by up to 2MB per hour per inbound peer and 5MB per hour per outbound peer [3]. Nodes operating with the `-blocksonly` setting faced reduced risk as transaction announcements constitute the majority of queued messages [3]. ## Undo File Overflow The third vulnerability, rated low severity, involves a potential undo file overflow during extreme network conditions [1]. Miners could theoretically corrupt undo data on other nodes, leading to shutdowns during specific block reorganizations or immediately upon connection on Windows and 32-bit systems [1]. Undo files, unlike block files capped at 128 MiB, have no size limit, and positions were stored as 32-bit integers [1]. By generating valid blocks with massive undo data exceeding 4 GiB, miners could cause the 32-bit position to wrap, overwriting older data [1]. If an affected block was disconnected during a reorganization, the node failed to read the undo data and shut down [1]. Restarting offered no resolution, necessitating a `-reindex` [1]. Exploiting this on 64-bit systems required mining thousands of nonstandard blocks over roughly a month, alongside executing a precise reorganization [1]. The fix transitioned block and undo file positions to 64-bit integers and utilized 64-bit file positioning calls on Windows [1]. However, 32-bit systems and nodes storing blocks on FAT32 filesystems remain affected [1]. ## Sources 1. [Undo file overflow under extreme conditions](https://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/) — Bitcoin Core, 2026-10-28 2. [Unbounded memory growth through TCP urgent data on non-Linux systems](https://bitcoincore.org/en/2026/10/28/disclose-tcp-oom/) — Bitcoin Core, 2026-10-28 3. [Slow unbounded memory growth on paused pre-BIP31 peers](https://bitcoincore.org/en/2026/10/28/disclose-fpausesend-oom/) — Bitcoin Core, 2026-10-28 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai