CVE-2015-20111: Bitcoin Core

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in conjunction with CVE-2015-6031 exploitation.

Affected products

• Bitcoin Bitcoin Core: before 0.12 (fixed in 0.12)

Published 2024-11-18. Last modified 2026-06-17.