Bitcoin Core bug lets malicious peers crash Windows and Mac nodes
Bitcoin Core released fixes for three node vulnerabilities across its maintained branches, including an issue that could crash connected Windows, macOS, and BSD nodes. New coverage also says the problem was a medium-severity memory exhaustion flaw, that Linux was not affected by that flaw, and that separate 32-bit and FAT32 exposure still remains.
Key claims & sources
What it means
Bitcoin Core is the reference client most node operators and miners run to validate transactions and enforce consensus rules, maintained through a volunteer release cycle with periodic security disclosures. On October 28, 2026, the project disclosed three vulnerabilities after shipping fixes in versions 29.5, 30.4, 31.2 and 32.1, following the same fix-first-disclose-later pattern used after the 2018 inflation bug. The most severe of the three let a remote peer exhaust memory and crash a node running Windows, macOS or BSD.
Operators running Windows, macOS or BSD builds need to upgrade to 29.5, 30.4, 31.2 or 32.1 to close the medium-severity memory exhaustion hole, since any connected peer could otherwise force a crash. Linux node runners face no immediate exposure from this specific flaw and can patch on their normal cycle. Miners, exchanges and lightning node operators relying on non-Linux infrastructure carry the heaviest short-term risk until they update, while unpatched nodes remain reachable targets for anyone who already has the exploit.
The flaw surfaced through Project Loupe's automated large-language-model scan of the Bitcoin Core codebase rather than a human audit, and the finding then became public. That sequencing matters: AI tools now probe consensus-critical software for weaknesses faster than traditional review, which can harden the network but also hands attackers a public roadmap before every node has patched. Bitcoin's security has always rested on operators updating voluntarily; automated discovery only sharpens the gap between those who patch quickly and those who do not.
Watch whether Bitcoin Core issues a fix for the separate low-severity flaw still open on 32-bit systems and FAT32 storage, which the October patch round left untouched. No release branch currently addresses it, so operators on older or embedded hardware stay exposed until developers schedule a follow-up. The pace at which node operators move to 29.5, 30.4, 31.2 or 32.1 will also show how much of the non-Linux network remains vulnerable in the meantime.
Market reaction i
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Crypto Briefing
scoop
AMBCrypto
echo
Crypto Economy
context
MEXC
context