Security readout for executives and security teams
Plain-English summary
This was an early Bitcoin software flaw where a specially crafted transaction could bypass supply rules and create many bitcoins. For executives, the risk is mainly historical or legacy-system exposure: any organization still running wxBitcoin or bitcoind before 0.3.11 should treat it as unacceptable for production use.
Executive priority
Prioritize only if the organization runs legacy Bitcoin software, maintains old forks, or operates archival nodes. For normal modern environments, urgency is likely low, but confirmed pre-0.3.11 exposure should be removed immediately.
Technical view
CVE-2010-5139 is an integer overflow in wxBitcoin and bitcoind before 0.3.11. The overflow allowed transaction values to evade intended economic restrictions, enabling unauthorized bitcoin creation through a crafted transaction. The provided sources do not include CVSS, CWE, complete CPE data, or detailed remediation notes beyond the affected pre-0.3.11 boundary.
Likely exposure
Exposure appears limited to legacy Bitcoin nodes or software derived from wxBitcoin or bitcoind before 0.3.11. The source bundle does not identify modern affected products, downstream forks, hosted services, or supported platforms.
Exploitation context
The CVE describes remote attackers using a crafted Bitcoin transaction. The provided bundle does not identify CISA KEV status, current active exploitation, exploit tooling, or affected live networks beyond the historical pre-0.3.11 software.
Researcher notes
The public record in the bundle is sparse: no CVSS vector, CWE, CPE, or detailed patch advisory is supplied. Analysis should stay tied to wxBitcoin and bitcoind before 0.3.11 unless additional primary sources identify downstream exposure.
Mitigation direction
- Do not operate wxBitcoin or bitcoind versions before 0.3.11.
- Check Bitcoin project guidance and historical release notes for the correct upgrade path.
- Retire or isolate legacy nodes until version and chain state are verified.
- Review dependent forks or embedded code for inherited transaction-value overflow logic.
Validation and detection
- Inventory any Bitcoin node binaries, containers, and embedded wallet components.
- Confirm versions are 0.3.11 or later where this code lineage exists.
- Review logs and records for unexpected value creation or chain inconsistencies.
- Document whether any legacy research or archival systems remain intentionally vulnerable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2010-5139 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bitcointalk.org/index.php?topic=822.0CVE reference · x_refsource_CONFIRM
- https://en.bitcoin.it/wiki/CVEsCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.