CVE-2026-117601
Received Received - Intake

Electrum Wallet Signature Verification Flaw

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-117601
EUVD
EUVD-2026-110850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spesmilo electrum 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Electrum before version 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. A malicious server can replace a user's recently broadcast transaction with a conflicting invalid one that sends funds to the attacker's address. The user's wallet history shows the fake transaction as unconfirmed, tricking them into using Replace-by-Fee (RBF) to increase the fee. When the user signs the RBF transaction, they unknowingly authorize the attacker's fraudulent transaction.

Detection Guidance

To detect this vulnerability, check your Electrum wallet version. Run 'electrum --version' in the terminal. If the version is below 4.8.3, your system is vulnerable. Additionally, monitor for unexpected transaction replacements or zero-fee transactions in your wallet history.

Impact Analysis

If you use Electrum versions before 4.8.3, an attacker controlling a malicious server could steal your funds by replacing your transaction with one paying them instead. You might unknowingly sign a fraudulent transaction when trying to increase the fee via RBF, resulting in financial loss. Users connected to trusted or self-hosted servers are not affected.

Mitigation Strategies

Immediately upgrade Electrum to version 4.8.3 or later using your package manager or from the official Electrum website. Avoid using untrusted Electrum servers; switch to a self-hosted or trusted server if possible. Manually verify transaction outputs before signing any transactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart