Bitcoin developers have just publicly disclosed a high-severity Bitcoin memory bug that allowed miners to remotely crash other nodes or potentially execute code on them. The vulnerability, designated CVE-2024-52911, affected Bitcoin Core versions 0.14.1 through 28.4 and was privately reported by Cory Fields of the MIT Digital Currency Initiative (MIT DCI) in November 2024.
How the Bitcoin memory bug worked
The Bitcoin memory bug was a use-after-free vulnerability in the script validation engine. Basically, during block validation, Bitcoin Core pre-calculates and caches transaction input data, then dispatches script validation work to background threads that use computer memory. But if subjected to an attack, the node could continue reading from “cached” memory after that data had already been freed by another process. Per findings, this abnormal memory state could allow remote code execution.
A miner that was able to exploit the bug would have had to produce a specially crafted invalid block with sufficient proof-of-work (PoW), thus burning hashpower (without the ability to earn coinbase rewards). The high cost associated with this method of attack would have most likely never been used in practice.
Discovery and patching
In November 2024, Fields privately reported the bug. Within four days, Pieter Wuille pushed a fix proposal (PR 31112) to fix the memory defect disguised as a normal maintenance to avoid raising alarms. The fix was merged by December 2024 and included in the April 2025 release (version 29.0) of Bitcoin Core. The last software version with the memory flaw (28.x) was obsolete on April 19, 2026.
Current risk
According to Clark Moody’s dashboard, approximately 43 percent of Bitcoin nodes are still running pre-v29 software, leaving them vulnerable to the Bitcoin memory bug. Bitcoin‘s consensus rules were not changed; the fix only affects how node software handles memory.
Bitcoin Core developer Niklas Gögge noted this is “the first ever memory safety issue” disclosed in the project’s history.
What to do now
For node operators running versions below 29.0, it is critical to upgrade immediately. The Bitcoin Core team follows a policy of publicly disclosing old, previously secret bug fixes after allowing sufficient time for upgrades. Also, following the bug disclosure, made on May 5, 2026, gave node operators over a year to patch since the fix was merged in December 2024.