Bitcoin Core 32.0 update set for October release with wallet protocol changes

Bitcoin Core 32.0 entered final testing on September 14, 2026, with a target release date of October 10, 2026. The major update introduces parallel block prefetching with eight default threads to accelerate validation and adds a mempool-based transaction fee estimator to lower costs. It also transitions four wallet commands to default to PSBTv2, requiring compatibility checks for downstream services. Crucially, developers patched a command-execution vulnerability in wallet configurations and a memory-exhaustion flaw in the new web server before release.

Bitcoin Core 32.0 release schedule

• ▪Bitcoin Core v32.0rc1 identifies prerelease software and does not signal a new consensus-rule activation or change Bitcoin's consensus rules.
• ▪Bitcoin Core developers aim to release the finished, production-final version of Bitcoin Core 32.0 on October 10, 2026.
• ▪Bitcoin Core v32.0rc1 was tagged with a verified signature on September 14, 2026, entering the final testing cycle.

Transaction fee estimation improvements

• ▪The combined fee estimation path in Bitcoin Core 32.0 requires both estimators to succeed, and failure paths can cause errors if either component fails.
• ▪Bitcoin Core 32.0 adds a second fee estimator that looks at transactions currently waiting in the mempool to be confirmed, in addition to looking at fees in previous blocks.
• ▪The default estimatesmartfee path in Bitcoin Core 32.0 combines block-policy and mempool estimators, allowing the software to recommend lower fees when network congestion clears.

PSBT version 2 default changes

• ▪Four Bitcoin Core RPC commands used to create partially signed transactions will default to the PSBTv2 format in version 32.0.
• ▪Applications using Bitcoin Core 32.0 can still request the older PSBT format instead of the default PSBTv2.
• ▪The default shift to PSBTv2 in Bitcoin Core 32.0 requires compatibility checks across downstream wallet parsers, signers, and services built directly around those commands.

Security vulnerability fixes

• ▪Bitcoin Core 32.0 fixes a command-execution vulnerability affecting non-Windows systems where an authenticated user with wallet-creation permissions could execute commands via specially crafted wallet names.
• ▪The command-execution vulnerability in Bitcoin Core affected configurations since version 24.0 that had the walletnotify feature enabled.
• ▪Bitcoin Core 32.0 mitigates the command-execution vulnerability by treating wallet names as literal text instead of allowing parts of the name to be interpreted as commands.

Block processing performance improvements

• ▪Rebuilding the transaction index in Bitcoin Core 32.0 uses less than half the disk space, but downgrading to older releases requires another hours-long rebuild because they cannot read the new format.
• ▪The parallel prefetching feature in Bitcoin Core 32.0 defaults to eight worker threads, supports up to 16 threads, and can be disabled by the operator.
• ▪Bitcoin Core 32.0 introduces parallel prefetching of transaction outputs during block connection, allowing nodes to fetch transaction data using several processing threads at once.

Memory exhaustion vulnerability patch

• ▪Testing of the memory-exhaustion vulnerability in Bitcoin Core 32.0 showed that 16 unauthenticated REST connections could increase a test node's memory usage from 46 MB to about 3 GB in roughly a minute.
• ▪The memory-exhaustion vulnerability in Bitcoin Core 32.0 allowed a client to send data that accumulated in memory faster than the server could clear it, potentially running the node out of memory.
• ▪Developers patched a memory-exhaustion vulnerability in Bitcoin Core 32.0's new web server before its stable release, which was identified during an audit using Moonshot AI's Kimi K3 model.