Bitcoin Core discloses undo-file overflow vulnerability affecting extreme storage conditions

Bitcoin Core disclosed CVE-2026-117346 on October 28, 2026, identifying an undo-file overflow vulnerability associated with extreme block-storage conditions.

The issue can allow specially constructed blocks to cause an overflow in an undo-file position. That can corrupt undo data and lead an affected node to shut down during a chain reorganization.

Bitcoin Core described the vulnerability as low severity and said exploitation is impractical on 64-bit systems. The disclosure nonetheless sets out important limitations for operators using 32-bit systems or FAT32 for block storage.

What causes the undo-file overflow

The vulnerability arises because Bitcoin Core stored positions for block and undo files as 32-bit values. Under the conditions described in the disclosure, a specially constructed block can cause an undo-file position to overflow.

Undo data is used when a node must disconnect blocks during a reorganization. If that data is corrupted, the node can shut down while processing the reorganization.

Bitcoin Core pull request #36669, merged on October 26, changes the relevant flat-file positions to 64-bit integers. The change also uses 64-bit file-positioning calls on Windows and does not alter the on-disk representation.

Fixed releases and remaining limitations

Bitcoin Core released fixes in versions 29.5, 30.4, 31.2, and 32.1 for supported 64-bit systems. Operators should review the release available for their deployment and account for their operating system and storage configuration.

The disclosure says 32-bit systems remain affected. Nodes that store blocks on FAT32 also remain affected because of documented limitations, despite the 64-bit position changes.

The practical risk therefore depends on the node environment. Bitcoin Core’s low-severity assessment reflects the stated difficulty of exploiting the issue on 64-bit systems, rather than an assertion that every configuration is protected.

• Fixed versions: Bitcoin Core 29.5, 30.4, 31.2, and 32.1 on supported 64-bit systems.
• Still affected under the disclosure’s limitations: 32-bit systems and FAT32 block-storage configurations.

Context for node operators

The disclosure concerns node reliability and data handling during a reorganization, not a change to Bitcoin’s consensus rules. It is separate from other recently disclosed Bitcoin Core issues, including the paused pre-BIP31 peer vulnerability.

Node operators can use the fixed-release information to assess whether their current version and platform fall within the supported 64-bit configurations addressed by the patch. This report does not constitute financial or operational advice.

Continue reading: paused pre-BIP31 peer vulnerability on BTCNews.

Continue reading: Bitcoin Core 30.3 release on BTCNews.

Sources

• Bitcoin Core: CVE-2026-117346 – Undo file overflow under extreme conditions
• Bitcoin Core GitHub repository: refactor: store positions as a 64 bits integer in flatfiles – #36669
• Bitcoin Core GitHub repository: Bitcoin Core releases
• Bitcoin Core GitHub repository: Bitcoin Core v32.1 release notes

Our creator. Creates amazing NFT collections! Support the editor - Bitcoin_Man(TON) / Bitcoin Man Stickers(TON) / BM Numbers (TON) / Comics Book (TON) / Bitcoin_Man (ETH)

Pi Network (Guide)is a new digital currency developed by Stanford PhDs with over 55 million participants worldwide. To get your Pi, follow this link https://minepi.com/Tsybko and use my username (Tsybko) as the invite code.

Binance: Use this link to sign up and get $100 free and 10% off your first months Binance Futures fees (Terms and Conditions).

Bitget: Use this link Use the Rewards Center and win up to 5027 USDT!(Review)

Bybit: Use this link (all possible discounts on commissions and bonuses up to $30,030 included) If you register through the application, then at the time of registration simply enter in the reference: WB8XZ4 - (manual)