Security readout for executives and security teams
Plain-English summary
This old Bitcoin Core issue could let a remote party link wallet addresses to IP addresses by abusing fee handling for large transactions. The business impact is privacy exposure, not confirmed fund theft or code execution. The source bundle does not provide a CVSS score or evidence of active exploitation.
Executive priority
Prioritize if the organization operates legacy Bitcoin wallet infrastructure or has privacy-sensitive blockchain operations. Otherwise, urgency is low to moderate because affected software is from 2013-era versions and no active exploitation is cited.
Technical view
CVE-2013-2272 affects bitcoind and Bitcoin-Qt versions before listed 0.4.x, 0.5.x, 0.6.x, and 0.7.x release-candidate boundaries. The weakness is in CTxMemPool::accept penny-flooding protection and can reveal address-to-IP associations through large low-fee transactions. No CWE, CVSS vector, or detailed workaround is provided.
Likely exposure
Exposure is most plausible for organizations still running very old bitcoind or Bitcoin-Qt wallet nodes from the affected version ranges. Modern, maintained Bitcoin clients are not identified as affected in the source bundle.
Exploitation context
The CVE describes remote exploitation for privacy deanonymization. It does not cite CISA KEV, active exploitation, public weaponization, or exploitation prevalence. Treat exploitation status as unconfirmed from the provided sources.
Researcher notes
The useful technical boundary is version-based, not CPE-based, because the source bundle lists n/a affected metadata while the description names bitcoind and Bitcoin-Qt ranges. Evidence is incomplete for severity scoring, CWE classification, exploit maturity, and operational workaround details.
Mitigation direction
- Inventory any legacy bitcoind and Bitcoin-Qt deployments.
- Compare versions against the affected ranges listed in the CVE.
- Move affected clients past the listed fixed release boundaries or current vendor guidance.
- Retire unsupported wallet nodes where upgrade is not practical.
- Review wallet-node network exposure and privacy assumptions.
Validation and detection
- Confirm whether any Bitcoin wallet nodes run bitcoind or Bitcoin-Qt.
- Record exact client versions for all discovered nodes.
- Check whether versions fall before the CVE's listed release-candidate boundaries.
- Verify upgrade status against official Bitcoin project guidance.
- Document any remaining legacy nodes and compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2013-2272 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bitcointalk.org/?topic=135856CVE reference · x_refsource_CONFIRM
- https://en.bitcoin.it/wiki/CVEsCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.