High severity · published Jul 7, 2023
CVE-2023-37192
Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Bitcoin Core · Bitcoin
22.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37192
Product
https://bitcoin.org/en/bitcoin-core/
Exploit
https://satoshihunter1.blogspot.com/2023/06/the-bitcoin-app-is-vulnerable-to-hackers.html
Exploit
https://www.youtube.com/watch?v=oEl4M1oZim0
More from Bitcoin Core
9.8
CVE-2015-20111
miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a…
7.5
CVE-2025-46597
Bitcoin Core 0.13.0 through 29.x has an integer overflow
7.5
CVE-2025-54605
Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2)
7.5
CVE-2025-54604
Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2)
7.5
CVE-2024-52912
Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug