Bitcoin Core Patches Three AI-Discovered Security Flaws

Bitcoin Core developers have patched three security vulnerabilities discovered through automated large language model scanning, including two memory-exhaustion flaws and an edge-case storage bug. The project’s official security advisories show that fixes were released across versions 29.5, 30.4, 31.2 and 32.1 after Project Loupe surfaced the vulnerabilities for human validation. Project Loupe is an automated security initiative developed by Elias Rohrer at Spiral, with Gregory Sanders validating the findings before they reached the Bitcoin Core security team.

The release structure requires qualification. Bitcoin Core 32.1 arrived on October 27, followed by 29.5 and 30.4 on October 28; 31.2 was also released with the fixes. Version 29.x simultaneously reached End of Life when 32.1 launched, meaning 29.5 represents a final security backport rather than an actively maintained branch going forward. The development cycle followed earlier Bitcoin Core 32 release-candidate testing, although 32.0 itself was never fully released because of last-minute issues.

Two Bugs Could Exhaust Node Memory

The more immediately exploitable flaw, CVE-2026-117350, affects the select() socket backend used on Windows, macOS and BSD. A malicious connected peer could send TCP urgent data to bypass Bitcoin Core’s normal backpressure controls and continue forcing data into memory. The result could be a trivial remote crash once the node exhausted available RAM, while Linux nodes were unaffected because they use the separate poll() backend.

A second Medium-severity issue, CVE-2026-117349, affected peers pretending not to support BIP31 nonced pings. Such peers could remain paused indefinitely while Bitcoin Core continued queuing transaction announcements. Memory could grow by as much as 2 MB per hour for each inbound peer and 5 MB per hour for each outbound peer, although -blocksonly nodes were substantially less exposed because transaction announcements make up most of the queued data.

These flaws affect node availability rather than Bitcoin consensus or user keys. That security boundary is different from compromises such as the Injective SDK supply-chain attack, where malicious developer software could directly expose private keys. A Bitcoin Core node crash can interrupt validation and relay for an individual operator without giving the attacker authority to spend coins or alter Bitcoin’s consensus rules.

Undo File Overflow Requires Extreme Conditions

The third vulnerability, CVE-2026-117346, involves Bitcoin Core‘s undo files, which store information needed when blocks are disconnected during reorganizations. File positions were represented with 32-bit integers even though an undo file could theoretically exceed 4 GiB. A miner capable of constructing thousands of specially shaped blocks and triggering a precisely timed reorganization could corrupt undo references and force affected nodes to shut down. Bitcoin Core rates the issue Low severity because practical exploitation is difficult.

The fix changes file-position handling for supported 64-bit systems, but the limitation is not eliminated everywhere. 32-bit systems and nodes storing block data on FAT32 remain affected, making platform and filesystem configuration relevant even after the maintenance releases. The issue demonstrates why client software can retain unusual operational edge cases despite leaving the Bitcoin protocol itself unchanged.

AI Discovery Changes Bitcoin Core Disclosure Policy

All three vulnerabilities were classified as “easily discoverable,” a category Bitcoin Core now treats differently under its security policy. When a vulnerability can be found with minimal effort, including through simple LLM-assisted analysis, developers publish patched point releases and the security advisory as soon as fixes exist across maintained branches, rather than applying the normal severity-based embargo.

That approach reflects a broader change in software-security economics as automated tools lower the cost of finding implementation flaws. Similar pressure is visible across Web3 infrastructure, where critical PHP vulnerabilities recently required rapid security updates. Automated discovery increases defensive coverage but also reduces confidence that straightforward bugs will remain obscure for long periods, making faster coordinated patching more valuable.

Bitcoin Core reports no confirmed exploitation of the three newly disclosed vulnerabilities. The current operational priority is therefore patch status rather than incident recovery, with 32.1 now the newest major release and older operators encouraged to move onto a maintained branch rather than relying indefinitely on the 29.5 backport.