Bitcoin Core Discloses Three AI-Found Bugs Including a Windows and Mac Node Crash
By Node Zero
October 29, 2026
Bitcoin Core published three security advisories for “easily discoverable” vulnerabilities — the first public batch under the project’s accelerated disclosure rules after the October 22 policy shift on LLM-rediscoverable bugs. Antoine Poinsot’s October 28 note to the bitcoin-dev list and CoinDesk’s overnight wrap say the findings came from an automated language-model scan, were human-verified, and shipped with point releases 29.5, 30.4, 31.2, and 32.1. Two advisories are rated medium severity and one low; none of the three carried CVE IDs.
The headline flaw is unbounded memory growth through TCP urgent (out-of-band) data on non-Linux systems. Bitcoin Core’s advisory and The Defiant / Crypto Briefing wraps say a malicious peer can send specially marked traffic so that, on platforms where select() keeps reporting pending urgent data that recv() never returns, the node’s queue grows without limit until it runs out of memory and crashes. Windows, macOS, and BSD are in scope; Linux is unaffected on this particular bug because it monitors sockets differently. A crash takes the node offline for validation and relay until an operator restarts it — it is not a remote key-theft path.
The second medium advisory covers slow memory growth tied to peers that pause sends under pre-BIP31 behavior. CoinDesk, citing the advisory, says a connected peer can claim an outdated protocol version and stall so messages pile up at up to 2 MB an hour per inbound connection and 5 MB an hour per outbound connection. The scan reportedly flagged that issue on September 15, and another developer independently found the same flaw about six days later — the exact race the new “easily discoverable” process was meant to shorten.
The low-severity third advisory concerns undo-file overflow during reorganizations. A miner could craft blocks that push reorganization undo data past size limits. On 64-bit machines CoinDesk says the attack would take roughly a month of the network’s entire block production; on Windows and 32-bit systems the node can fail outright, and “restarting does not help.” The Defiant notes 32-bit machines and nodes storing blocks on older FAT32 drives can remain exposed even after the patch for that lane. Attribute residual-risk language to those advisories — not to a claim of observed in-the-wild exploitation; the advisories do not say exploitation was seen.
Patch math is branch-specific. Operators on 29.x, 30.x, and 31.x should move to 29.5, 30.4, and 31.2 respectively; 32.1 is the latest major-line release. Poinsot’s mail says 32.1 and 31.2 landed October 27, with 30.4 and 29.5 on October 28 alongside the advisories. Release notes also flag three separate medium- and high-severity issues fixed in version 30.0 that remain under the regular embargo and are due for disclosure in about two weeks — unrelated to this easily-discoverable batch. Prefer bitcoincore.org advisories and the dated bitcoin-dev mail over secondary headlines that invent CVEs or claim Linux is equally crashable on the TCP-urgent path.
For NFT and crypto desks, the practical read is infrastructure hygiene on the cash and settlement rails collectors still clear through bitcoin-linked venues. Home-node operators on Windows or macOS should treat the TCP-urgent advisory as a same-day upgrade notice; exchanges and miners face operational downtime risk if unpatched peers drop offline, not a wallet drain. Shut down Bitcoin Core completely before installing a patched binary, per the project’s release notes, so the swap does not leave a half-upgraded process listening. Leave Hyperliquid HYPE burn prints and Utah/Kalshi criminal filings closed — today’s unused primary is the first live “easily discoverable” advisory set after the October 22 policy chapter.
Next protocol beat: Watch upgrade share on 29.5 / 30.4 / 31.2 / 32.1, any follow-on advisory clarifying FAT32 or 32-bit residual undo risk, and the scheduled two-week disclosure of the three 30.0-era medium/high bugs — until those land, treat the three published advisories and the patched point releases as the live operating facts.
Bottom line: Bitcoin Core’s first easily-discoverable advisory batch flags a non-Linux TCP-urgent crash path plus two more memory bugs, with fixes in 29.5, 30.4, 31.2, and 32.1.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
