CVE-2026-117601
Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
| CWE | CWE-347 |
| Vendor | spesmilo |
| Product | electrum |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for spesmilo electrum
Be the first to know when new high vulnerabilities affecting spesmilo electrum are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
spesmilo / electrum
0 < 4.8.3
References
github.com: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v github.com: https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb vulncheck.com: https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions
Credits
🔍 Raju-K12