Andrew Chow

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.19.0 Description: The issue might allow remote attackers to execute arbitrary code when another application unsafely passes the `-platformpluginpath` argument to the `bitcoin-qt` program. This could be demonstrated by an `x-scheme-handler/bitcoin` handler for a `.desktop` file or a web browser. The discoverer notes that they believe this issue cannot actually be exploited. Recommendations: For versions prior to 0.19.0, update to version 0.19.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `-platformpluginpath` argument in the `bitcoin-qt` program to minimize the risk of exploitation.

The issue allows for denial of service through memory exhaustion, triggered by the remote network alert system. This system is deprecated since Q1 2016. An attacker can exploit this by signing a message with a certain private key that had been known by unintended actors, due to an infinitely sized map. This affects not only Bitcoin Core but also other uses of the codebase, including Bitcoin Knots and many altcoins.