CVE-2026-117601GHSA-6jp4-8v48-cc5v
Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
spesmilo electrum
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 4.8.3electrumCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @stemshop.bsky.social: 🚨 CVE-2026-117601 — CVSS 9.3 CRITICAL Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions... 🔎 https://stemshop.top/cve/CVE-Bluesky: CVE posts, 27 Oct 2026
- @threatroundup.bsky.social: 🚨 Critical: CVE-2026-117601 in spesmilo electrum, CVSS 9.3. Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing… NBluesky: CVE posts, 27 Oct 2026
Description
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
Text from CVE List
Affected versions 2
- electrumaffected: all versions before 4.8.3CVE List
- electrumunaffected: 4.8.3CVE List
References 3
- github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999ebFixvia CVE List
- github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5vAdvisoryvia CVE List
- vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactionsAdvisoryvia CVE List