Bitcoin Core discloses AI-found bug that crashed Windows, Mac nodes

Bitcoin Core has published details of three vulnerabilities turned up by an AI-assisted code scan, including one that let a remote peer crash nodes running on Windows, macOS or BSD, CoinDesk reported. Fixes went out on Oct. 27, and the advisories were made public on Wednesday.

Why these bugs are public so fast

Until last week, Core kept medium-severity issues secret for as long as a year so operators could upgrade first. On Oct. 22 the project changed that for bugs it judges "easily discoverable", arguing that large language models now make such flaws cheap to rediscover, as we covered in Bitcoin Core's new security policy. These three are the first disclosures under the new rule.

All three came from an automated scan that used a language model to read Core's source code. A human contributor checked every finding before it went to the security team.

The three bugs

• Remote memory crash (Windows, macOS, BSD). Flagged by the scan on Oct. 23 and confirmed the same day, it let any peer connected to a node send data until the node exhausted its memory and crashed.
• Stalling peer. Reported from the scan on Sept. 15 and found independently by another developer six days later, it let a peer claim an outdated protocol version and then stall. According to the advisory, messages then piled up in the victim's memory at up to 2 MB an hour per inbound connection and 5 MB an hour per outbound one.
• Reorg file overflow (low severity). Reported three times: by the scan and by two developers, in August and on Oct. 23. A miner could craft blocks that overflow the files a node keeps for chain reorganisations. On 64-bit machines this would need roughly a month of the network's entire block output; on Windows and 32-bit systems the node can fail outright, and "restarting does not help," the advisory warns. Nodes on 32-bit hardware or old FAT32 drives remain exposed even after the fix.

What node operators should do

If you run a node, install the latest release for your maintained version. Coins held in wallets are not at risk from these bugs: they target the availability of the software that relays and checks transactions, not private keys. If you are unsure what that software actually does, read our guide to what a bitcoin node is and the basics of how bitcoin works.

The release notes say three further medium- and high-severity bugs, fixed in version 30.0, will be disclosed in two weeks.