DEBIAN-CVE-2026-117601: Critical severity debian/electrum vulnerability

Q: Which installations are affected?

Electrum versions before 4.8.3 are affected. The listed affected software is Debian's electrum package.

Q: What must an attacker control to exploit this issue?

The attacker needs to operate or control a malicious server that the wallet uses. No user interaction is required for the transaction replacement itself, but the attacker relies on deceiving the user into fee-bumping and signing the displayed transaction.

Q: What behavior could indicate an attempted attack?

A just-broadcast transaction may disappear and be replaced in the wallet display by a conflicting zero-fee transaction that pays an attacker-controlled address. A prompt or apparent need to RBF fee-bump that replacement transaction is particularly suspicious.

Published Oct 27, 2026

Updated

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

Affected Software

3 affected componentsFixes available

debian/electrum*

debian/electrum<4.8.3+dfsg-1

4.8.3+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/electrum to a version that resolves this vulnerability.
Fixed in 4.8.3+dfsg-1

Event History

Oct 27, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which installations are affected?

Electrum versions before 4.8.3 are affected. The listed affected software is Debian's electrum package.

What must an attacker control to exploit this issue?

The attacker needs to operate or control a malicious server that the wallet uses. No user interaction is required for the transaction replacement itself, but the attacker relies on deceiving the user into fee-bumping and signing the displayed transaction.

What behavior could indicate an attempted attack?

A just-broadcast transaction may disappear and be replaced in the wallet display by a conflicting zero-fee transaction that pays an attacker-controlled address. A prompt or apparent need to RBF fee-bump that replacement transaction is particularly suspicious.

DEBIAN-CVE-2026-117601: Critical severity debian/electrum vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What must an attacker control to exploit this issue?

What behavior could indicate an attempted attack?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What must an attacker control to exploit this issue?

What behavior could indicate an attempted attack?