CVE-2026-117601 with a CVSS score of 9.3 is a critical missing signature verification vulnerability in Electrum's handling of mempool transactions supplied by the connected Electrum server. The affected software is electrum (pip) versions below 4.8.3. The flaw occurs in the light-client design, where the client trusts the main server for unconfirmed transaction history and does not validate signatures for conflicting mempool transactions before adding them to local history. An attacker who controls or compromises the Electrum server can exploit this over the network without direct user action by swallowing a newly broadcast transaction and replacing it in the client's history with an invalid conflicting transaction whose outputs point to an attacker-controlled address. Because the wallet displays the invalid transaction as unconfirmed, a user who manually fee-bumps it signs and pays a higher fee to the attacker. The business impact is direct financial loss, unauthorized transfer of funds, and loss of trust in wallet transaction integrity, especially for users relying on third-party servers rather than self-hosted trusted infrastructure.
We recommend you to update Electrum to version 4.8.3.[/subscribe_to_unlock_form]
CVE-2026-117601 with a CVSS score of 9.3 is a critical missing signature verification vulnerability in Electrum's handling of mempool transactions supplied by the connected Electrum server. The affected software is electrum (pip) versions below 4.8.3. The flaw occurs in the light-client design, where the client trusts the main server for unconfirmed transaction history and does not validate signatures for conflicting mempool transactions before adding them to local history. An attacker who controls or compromises the Electrum server can exploit this over the network without direct user action by swallowing a newly broadcast transaction and replacing it in the client's history with an invalid conflicting transaction whose outputs point to an attacker-controlled address. Because the wallet displays the invalid transaction as unconfirmed, a user who manually fee-bumps it signs and pays a higher fee to the attacker. The business impact is direct financial loss, unauthorized transfer of funds, and loss of trust in wallet transaction integrity, especially for users relying on third-party servers rather than self-hosted trusted infrastructure.
We recommend you to update Electrum to version 4.8.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]