btcd Pre-Handshake Transaction Parser Panic

Impact

An unauthenticated remote host could crash btcd with a single crafted packet sent as the first message on a new connection, before any version handshake.

The peer layer fully decoded an incoming message before checking that the first message was a version. A packet with the tx command and a valid network magic and checksum therefore reached the transaction decoder. In witness parsing, readScriptBuf sliced a shared buffer using an attacker-supplied count without checking that the count fit the remaining buffer capacity, causing an out-of-range panic that terminated the process.

Any node with a reachable P2P listener was affected, and an outbound connection to an attacker-controlled peer was sufficient as well. The defect was introduced with the shared decode buffer in v0.24.0; earlier releases are not affected.

There is no fund-loss path. The node restarts cleanly, but the crash can be repeated at will.

Severity

Scored against the Lightning Labs severity taxonomy:

Dimension	Score	Reasoning
Impact	Low	Process crash, operator-recoverable by restart. No state corruption.
Attack Vector	High	Network. No handshake required; any host that can open a TCP connection.
Exploitability	High	Deterministic. One crafted packet.
Virality	Low	Per-victim. The panic fires during decode, before the transaction could be relayed, so nothing propagates.

Result: T3. Rule 3 (Impact = Low, base T3); no promotion because Virality is not High.

Patches

Fixed in btcd v0.26.0 by commit 3bf00861f (“wire: bound witness read to remaining slab”), which checks the requested count against the remaining buffer before slicing, together with 45135e677 (“peer: add panic recovery to message handling goroutines”). Both were merged as part of btcd#2479, whose title refers to unrelated address-validation work; this advisory is the description of the fix. Users should update to v0.26.0 or later.

Disclosure timeline

• Reported by Arthur Gervais on 2026-02-27.
• Fix merged 2026-03-10; released in btcd v0.26.0 on 2026-06-18.
• Public disclosure: 2026-09-21.