High severity · published Oct 27, 2026
CVE-2026-117601
Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
New
7.5
CVSS
–
EPSS
No
On KEV
Description
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electrum · spesmilo
before 4.8.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117601
github.com
https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb
github.com
https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
www.vulncheck.com
https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions
More from electrum
8.4
CVE-2026-117602
Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
4.3
CVE-2026-117603
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass