CVE-2025-46597

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-46597", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-23T13:49:19.162Z", "dateReserved": "2025-04-25T00:00:00.000Z", "datePublished": "2026-03-20T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-20T15:44:59.861Z"}, "descriptions": [{"lang": "en", "value": "Bitcoin Core 0.13.0 through 29.x has an integer overflow."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/bitcoin/bitcoin/releases"}, {"url": "https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-46597/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T13:48:10.373826Z", "id": "CVE-2025-46597", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T13:49:19.162Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-46597", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T13:48:10.373826Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T13:48:22.442Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/bitcoin/bitcoin/releases"}, {"url": "https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-46597/"}], "descriptions": [{"lang": "en", "value": "Bitcoin Core 0.13.0 through 29.x has an integer overflow."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-20T15:44:59.861Z"}}}, "cveMetadata": {"cveId": "CVE-2025-46597", "state": "PUBLISHED", "dateUpdated": "2026-03-23T13:49:19.162Z", "dateReserved": "2025-04-25T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-20T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bitcoin:bitcoin_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "51EFA058-A33B-4CB3-B8F6-202B4C827389", "versionEndExcluding": "0.30.0", "versionStartIncluding": "0.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bitcoin Core 0.13.0 through 29.x has an integer overflow."}, {"lang": "es", "value": "Bitcoin Core 0.13.0 hasta 29.x tiene un desbordamiento de entero."}], "id": "CVE-2025-46597", "lastModified": "2026-06-17T09:26:41.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-46597", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T13:48:10.373826Z", "version": "2.0.3"}}]}, "published": "2026-03-20T16:16:16.207", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-46597/"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/bitcoin/bitcoin/releases"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.13.0,29.x]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "bitcoin_core", "vendor": "bitcoin"}], "analysis": {"en": {"generated_at": "2026-04-02T13:26:29.638741+00:00", "value": {"mitigation_remediation": ["Upgrade Bitcoin Core to the latest stable release (v30.x or newer).", "Reparse the blockchain on upgraded nodes to ensure consistency.", "Verify that the node\u2019s transaction validation and block acceptance processes behave normally.", "Monitor the network for abnormal transaction patterns that may indicate exploitation attempts.", "Apply any additional mitigation guidance released by the Bitcoin Core developers."], "summary": {"action": "Apply patch", "impact": "Potential Value Corruption"}, "threat_synthesis": {"affected_systems": "Bitcoin Core software is affected. The vulnerability exists in releases from version 0.13.0 up to and including 29.x. Any system running these versions is at risk until a newer release is applied.", "description_and_impact": "This vulnerability is an integer overflow present in Bitcoin Core versions 0.13.0 through 29.x. It can cause a holder of a crafted transaction to manipulate counters or indices, potentially resulting in corrupted transaction values, compromised chain validation, or incorrect balance calculations. The weakness corresponds to CWE-190, which is an arithmetic overflow that can lead to data integrity issues.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high impact on the affected network, while an EPSS score below 1 percent suggests a low likelihood of widespread exploitation. The vulnerability is not recorded in the CISA KEV catalog, meaning no publicly known exploits are available at this time. The likely attack vector is through a malicious transaction that, when processed by a vulnerable node, triggers the integer wrap, allowing an attacker to alter values used in the consensus process. As no active exploits are documented, the risk remains primarily theoretical until confirmed by the community."}}}}, "created": "2026-03-23T09:53:31.641216+00:00", "updated": "2026-04-02T20:23:20.223582+00:00", "vendors": ["bitcoin", "bitcoin$PRODUCT$bitcoin_core"]}