CVE-2026-117601
CVE-2026-117601 · Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
CVSS 9.3 · Critical · Fix available
- Published
- Updated
Affected products and versions
electrum
- Versions
- ≥ 0, < 4.8.3: Affected (semver)
- 4.8.3: Not affected (semver)
Update to 4.8.3
Original sources
- https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
- https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb
- https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions
- https://nvd.nist.gov/vuln/detail/CVE-2026-117601