Bitcoin Core Discloses High-Severity Script Interpreter Remote-Crash Vulnerability
Bitcoin Core publicly disclosed CVE-2024-52911, a high-severity use-after-free flaw that could allow an attacker with sufficient proof-of-work to crash vulnerable nodes with a specially crafted block. The bug had been privately reported in 2024 and fixed in Bitcoin Core 29.0 before its May 5, 2026 public disclosure.
On May 5, 2026, Bitcoin Core publicly disclosed CVE-2024-52911, a high-severity vulnerability in block script validation. The flaw affected versions after Bitcoin Core 0.14.0 and before 29.0 and could cause a node validating a specially crafted block to access memory that had already been freed.
The vulnerability arose from the lifetime of data used by background script-validation threads. Under a particular invalid-block path, precomputed transaction data could be destroyed while a background validation thread still held a pointer to it. An attacker capable of producing a block with sufficient proof-of-work at the chain tip could potentially trigger the condition and crash vulnerable nodes. Bitcoin Core noted that use-after-free bugs can sometimes lead to remote code execution, although the constraints on the attacker-controlled block data made that outcome unlikely in this case.
The public-disclosure date came well after the security work itself. Cory Fields of MIT's Digital Currency Initiative privately reported the bug on November 2, 2024. Pieter Wuille placed a covert workaround into an existing pull request days later, the fix was merged in December 2024, and Bitcoin Core 29.0 shipped with the fix in April 2025. The last vulnerable 28.x release reached end of life on April 19, 2026, allowing coordinated disclosure on May 5.
The event is historically useful because it illustrates Bitcoin Core's practice of quietly fixing serious consensus-adjacent implementation flaws before publishing details that could endanger lagging nodes. The Bitcoin network itself did not experience a consensus failure, but the vulnerability showed how an implementation bug in block validation could create node-wide availability risk if paired with costly proof-of-work.