CVE-2021-3401

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-04 · updated 2026-06-17
Weakness: CWE-88

Description

Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer states "I believe that this vulnerability cannot actually be exploited."

Affected products

Bitcoin: before 0.19.0 — fixed in 0.19.0

How to fix

Upgrade to a fixed version: Bitcoin 0.19.0. Check the vendor advisory for mitigations.

References

https://achow101.com/2021/02/0.18-uri-vuln
https://github.com/bitcoin/bitcoin/pull/16578
https://achow101.com/2021/02/0.18-uri-vuln
https://github.com/bitcoin/bitcoin/pull/16578

Get alerted when CVE-2021-3401 or the next vulnerability affects your stack