CVE-2023-50428

MEDIUM EXPLOITED IN THE WILD

Bitcoin Core <26.0 - Bitcoin Knots <25.1.knots20231115 - Code Injec...

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-50428 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug."

References (6)

Core 6

Scores

CVSS v3 5.3
EPSS 0.0078
EPSS Percentile 51.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

VulnCheck KEV 2023-12-05
InTheWild.io 2023-12-09
Status published
Products (2)
bitcoin/bitcoin_core 0.9 - 26.0
bitcoinknots/bitcoin_knots 0.9 - 25.1
Published Dec 09, 2023
Tracked Since Feb 18, 2026