Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Electrum up to 4.8.2 lets malicious servers replace pending transactions

CVE-2026-117601 · published today
Summary

Versions of the Electrum Bitcoin wallet before 4.8.3 do not correctly check the digital signatures on transactions that are still waiting in the network's memory pool. A rogue server can swap a just‑sent transaction for a conflicting one that pays an attacker, causing the user to think their payment succeeded while it actually does not. Upgrade Electrum to version 4.8.3 or later to restore proper signature verification.

Original advisory text
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting on...
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-117601 · NVD
Track software like this
Free during beta