The vulnerability is a fast‑path verification flaw in bitcoinj's ScriptExecution.correctlySpends() for standard P2PKH and native P2WPKH spends. It allows an attacker to supply any signature and public key pair that verifies locally while the public key does not match the one committed to by the output being spent. This bypass permits the creation of transactions that the library accepts as valid but actually transfer funds to an unauthorized key, effectively enabling illicit spending of the output.

The impacted product is the bitcoinj Java Bitcoin library, any version prior to 0.17.1. Applications that use bitcoinj to verify P2PKH or P2WPKH transactions rely on this flawed logic and are vulnerable. The issue applies to all deployments of the library, whether used in full node clients, wallet implementations, or transaction‑processing services.

The CVSS score of 7.5 indicates high severity. EPSS is not available, so the current probability of exploitation is undetermined but potentially low, and the vulnerability is not listed in CISA's KEV catalog. The flaw can be exploited by an attacker who can influence the transaction being validated—crafting a transaction that passes bitcoinj’s local verification while the signatures are not bound to the original output. This makes the attack vector primarily application‑level, targeting clients or nodes that use the unpatched library to parse and spend input scripts.