High severity · published Jul 5, 2018
CVE-2016-10725
In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong…
7.5
CVSS
2.5%
EPSS
No
On KEV
Description
In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong order. This behavior occurs in the remote network alert system (deprecated since Q1 2016). This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Bitcoin Core · Bitcoin
before 0.13.0 · source: NVD
BI
Bitcoin-qt · Bitcoin
before 0.13.0 · source: NVD
BI
Bitcoind · Bitcoin
before 0.13.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-10725
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-10725
bitcoin.org
https://bitcoin.org/en/posts/alert-key-and-vulnerabilities-disclosure
Vendor Advisory
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures
github.com
https://github.com/JinBean/CVE-Extension
Third Party Advisory
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html
More from Bitcoin Core
9.8
CVE-2015-20111
miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a…
7.5
CVE-2025-46597
Bitcoin Core 0.13.0 through 29.x has an integer overflow
7.5
CVE-2025-54605
Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2)
7.5
CVE-2025-54604
Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2)
7.5
CVE-2024-52912
Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug