Public Disclosure: 2026-08-27
| Severity | Class | Difficulty to Trigger | Difficulty to Exploit |
|---|---|---|---|
| Medium | Out of Bounds (OOB) | Trivial | Unknown |
| Blockchain | Software | Status |
|---|---|---|
| eCash (XEC) | Bitcoin ABC Node | ✅ Fixed in v0.33.10 and widely deployed |
| eCash (XEC) | Bitcoin ABC CKPool | ✅ Fixed in PR12 |
| eCash (XEC) | Bitcoin ABC Trezor Firmware | ⚠️ Fixed in PR7750, pending backport and release |
| eCash (XEC) + Bitcoin Cash (BCH) | Trezor Firmware | ⚠️ Fixed in PR7750, pending release |
| Bitcoin Cash (BCH) | Bitcoin Cash Node | ⚠️ Fixed in PR2120, pending release |
A bug in CashAddr address decoding failed to require a full 8-byte checksum. Crafted addresses with a shorter payload could trigger an out-of-bounds condition and crash the process.
The full details as they were responsibly disclosed can be read here.
On node software, the issue does not appear reachable over the peer-to-peer network, and RPC handling catches the failure so the node process does not crash. Risk remains for any code path that decodes untrusted CashAddr strings.
Wallets, libraries, and other software derived from the same decoder may be more exposed. Impact is higher wherever a crash can reach end users.
Decoders should reject CashAddr strings whose payload is shorter than the 8-byte checksum. Bitcoin ABC fixed this in commit 8b31fb4780.