Bitcoin Core discloses miner crash bug CVE-2024-52911

The vulnerability involved Bitcoin Core's script interpreter during block validation, as reported by Bitcoin Core. A specially crafted block could cause a node to access memory after that data had already been freed during validation. During the validation process, Bitcoin Core pre-calculates transaction input data and sends script checks to background threads, creating conditions where an invalid block could destroy cached data while another thread still tried to read it. Because this attack is a use-after-free memory bug, remote code execution is possible during the abnormal memory state. Specifically, remote code execution could occur when the node's background script thread read cached, precomputed transaction data after it had been destroyed by a script validation, CScriptCheck. Bitcoin Core stated that this could allow an attacker with enough proof-of-work to crash victim nodes and potentially execute code on them, though it noted 'it is possible' the crash could support remote code execution, making that outcome 'unlikely' due to limits on block data.

The attack required significant resources, as reported by Bitcoin Core. A miner would need to produce a specially crafted block with enough proof-of-work to reach the chain tip, making the attack costly because such a block would be invalid and could not earn a normal block reward. The attacker would spend hashpower without collecting the usual mining payout. As Bitcoin Core noted, a guaranteed opportunity cost, these invalid blocks could not become eligible for an actual coinbase reward to recoup the miners' electricity costs. The mechanism of attack is easy to understand, albeit expensive to conduct, requiring electricity-guzzling hashpower toward mining special types of blocks.

Cory Fields of the MIT Digital Currency Initiative privately reported the bug on November 2, 2024, according to Bitcoin Core. The report included a proof of concept and a proposed way to reduce the risk. Pieter Wuille pushed a covert fix through PR 31112 four days later, with the pull request being titled 'Improve parallel script validation error debug logging' and merged on December 3, 2024. The fix was included in Bitcoin Core 29.0, which shipped with the patch in April 2025. The advisory purposefully read like a mundane, maintenance-style plumbing fix to avoid raising alarm bells, quickly gaining technical consensus for a merge into production. Bitcoin Core developer Niklas Gögge thanked Fields for his responsible disclosure, noting the importance of transparent bug reporting in maintaining network security.

The bug did not change Bitcoin's consensus rules and was tied to memory handling in Bitcoin Core software rather than the rules that define valid Bitcoin transactions or blocks, as reported by Bitcoin Core. Node operators using Bitcoin Core versions before 29.0 still face the old bug, as Bitcoin Core does not auto-update and users must install newer versions manually. According to one popular estimate, as much as 43% of Bitcoin nodes are still running vulnerable full node software based on pre-v29 code. A past report on blockchain decentralization risks cited research that 21% of Bitcoin nodes ran outdated Bitcoin Core software in June 2021**, highlighting why older client versions can remain a security concern long after fixes ship. Bitcoin Core confirmed that the bug had not been used in real attacks, with the advisory focusing on the flaw, the fix, and the disclosure timeline rather than reported incidents.