Achow101

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.19.0 Description: The issue might allow remote attackers to execute arbitrary code when another application unsafely passes the `-platformpluginpath` argument to the `bitcoin-qt` program. This could be demonstrated by an `x-scheme-handler/bitcoin` handler for a `.desktop` file or a web browser. The discoverer notes that they believe this issue cannot actually be exploited. Recommendations: For versions prior to 0.19.0, update to version 0.19.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `-platformpluginpath` argument in the `bitcoin-qt` program to minimize the risk of exploitation.

The issue allows for denial of service through memory exhaustion, triggered by the remote network alert system. This system is deprecated since Q1 2016. An attacker can exploit this by signing a message with a certain private key that had been known by unintended actors, due to an infinitely sized map. This affects not only Bitcoin Core but also other uses of the codebase, including Bitcoin Knots and many altcoins.

The issue arises from the incorrect order of operations in the remote network alert system, which is deprecated since Q1 2016. This allows a non-final alert to block the special "final alert" that is intended to override all other alerts. The problem affects not only Bitcoin Core but also other uses of the codebase, including Bitcoin Knots and many altcoins.