The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc…
Priority LOW 23CWE-310Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functionality of BSDDB, which allows context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries that are marked for deletion.
Why it matters now
EPSS 0.01623 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bitcoin:bitcoin_core:0.4.0:*:*:*:*:*:*:* | 0.4.0 | Vulnerable | Bitcoin |
| cpe:2.3:a:bitcoin:bitcoin_core:0.4.1:rc6:*:*:*:*:*:* | 0.4.1 rc6 | Vulnerable | Bitcoin |
| cpe:2.3:a:bitcoin:bitcoin_core:0.5.0:rc:*:*:*:*:*:* | 0.5.0 rc | Vulnerable | Bitcoin |
| cpe:2.3:a:bitcoin:wxbitcoin:0.4.0:*:*:*:*:*:*:* | 0.4.0 | Vulnerable | Bitcoin |
| cpe:2.3:a:bitcoin:wxbitcoin:0.4.1:rc6:*:*:*:*:*:* | 0.4.1 rc6 | Vulnerable | Bitcoin |
| cpe:2.3:a:bitcoin:wxbitcoin:0.5.0:rc:*:*:*:*:*:* | 0.5.0 rc | Vulnerable | Bitcoin |
- cpe:2.3:a:bitcoin:bitcoin_core:0.4.0:*:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·Bitcoin
- cpe:2.3:a:bitcoin:bitcoin_core:0.4.1:rc6:*:*:*:*:*:* Versions 0.4.1 rc6 Vulnerable ·Bitcoin
- cpe:2.3:a:bitcoin:bitcoin_core:0.5.0:rc:*:*:*:*:*:* Versions 0.5.0 rc Vulnerable ·Bitcoin
- cpe:2.3:a:bitcoin:wxbitcoin:0.4.0:*:*:*:*:*:*:* Versions 0.4.0 Vulnerable ·Bitcoin
- cpe:2.3:a:bitcoin:wxbitcoin:0.4.1:rc6:*:*:*:*:*:* Versions 0.4.1 rc6 Vulnerable ·Bitcoin
- cpe:2.3:a:bitcoin:wxbitcoin:0.5.0:rc:*:*:*:*:*:* Versions 0.5.0 rc Vulnerable ·Bitcoin
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2011-4447
- 2026-10-03 Alias added: GHSA-3f65-5prq-693p
References
More Bitcoin Core vulnerabilities
- TI-2023-18826 Memory management and protection issues in Bitcoin Core v22 allows attackers to modify… CVSS 3.1HIGH 7.5
- TI-2018-12251 Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and… CVSS 3.1HIGH 7.5
- TI-2024-23274 Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn… CVSS 3.1HIGH 7.5
- TI-2024-35417 Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite… CVSS 3.1HIGH 7.5
- TI-2024-35412 Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory… CVSS 3.1HIGH 7.5
- TI-2019-15274 Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon… CVSS 3.1HIGH 7.5
Sources
- CVE-2011-4447 · CVE Program
- CVE-2011-4447 · NVD
- FIRST EPSS
- GHSA-3f65-5prq-693p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences