Live › vulnerability › CVE-2026-117601
Go to dashboardElectrum before 4.8.3 does not verify signatures on wallet-owned inputs of unconfirmed mempool transactions. A malicious Electrum server can replace a just-broadcast transaction with a conflicting zero-fee copy that pays an attacker address, and the wallet can show it as valid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Any user running Electrum before 4.8.3 who broadcasts transactions through a server they do not fully control. The risk is the server returning a conflicting unconfirmed transaction that the wallet fails to reject. Users who run only trusted self-hosted servers or have already upgraded can skip it.
No product ranges from the sources yet.
electrum version and confirm the installed version is below 4.8.34.8.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
This page as .md · .json · in your agent: get_signal("CVE-2026-117601")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.