CVE-2026-117601: Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Electrum versions before 4.8.3 are exposed when handling unconfirmed transactions through a malicious server. The attack targets wallet-owned inputs in mempool transactions.
What must an attacker do to exploit the issue?
The attacker must operate or control a server that can replace a just-broadcast transaction with a conflicting transaction. They then rely on the user being tricked into using RBF fee bumping and signing the displayed replacement.
Is user interaction required for impact?
Yes. The user must be induced to RBF fee-bump and sign the invalid zero-fee transaction copy that pays an attacker-controlled address.
What is the remediation?
Update Electrum to version 4.8.3 or later. Versions before 4.8.3 do not verify the relevant signatures in unconfirmed mempool transactions.