Is CVE-2026-44714 actively exploited?

No active exploitation of CVE-2026-44714 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44714 be exploited remotely?

Yes. CVE-2026-44714 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44714?

CVE-2026-44714 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-44714

HIGH

CVE-2026-44714

CWE-347Published: May 15, 2026· Updated: May 18, 2026

7.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.0th

Official Description

The bitcoinj library is a Java implementation of the Bitcoin protocol. Prior to 0.17.1, ScriptExecution.correctlySpends() contains two fast-path verification bugs for standard P2PKH and native P2WPKH spends in core/src/main/java/org/bitcoinj/script/ScriptExecution.java. In both branches, bitcoinj verifies an attacker-controlled signature/public-key pair but fails to verify that the public key is the one committed to by the output being spent. As a result, any attacker keypair can satisfy bitcoinj's local verification for arbitrary P2PKH and P2WPKH outputs. This vulnerability is fixed in 0.17.1.

NVD Source

Technical Analysis

CVE-2026-44714 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.