CVE-2023-37192

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bitcoin.org/en/bitcoin-core/Product
https://satoshihunter1.blogspot.com/2023/06/the-bitcoin-app-is-vulnerable-to-hackers.htmlExploit, Third Party Advisory
https://www.youtube.com/watch?v=oEl4M1oZim0Exploit, Third Party Advisory
https://bitcoin.org/en/bitcoin-core/Product
https://satoshihunter1.blogspot.com/2023/06/the-bitcoin-app-is-vulnerable-to-hackers.htmlExploit, Third Party Advisory
https://www.youtube.com/watch?v=oEl4M1oZim0Exploit, Third Party Advisory

Timeline

Published: Jul 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-371946.7A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMAT CVE-2023-371954.4A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMAT CVE-2023-371968.8A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could CVE-2023-371978.8A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could CVE-2023-371987.2A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admi CVE-2023-371997.2A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admi CVE-2023-37206.5The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make log CVE-2023-372005.5A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacin CVE-2023-372018.8An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox CVE-2023-372028.8Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment CVE-2023-372037.8Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users int CVE-2023-372046.5A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational funct