{"id":"CVE-2026-117601","aliases":["GHSA-6jp4-8v48-cc5v"],"url":"https://o3.security/vulnerability/CVE-2026-117601","summary":"Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions","details":"Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.","published":"2026-10-27T13:09:51.347Z","modified":"2026-10-28T02:54:50.444235873Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb","label":"spesmilo/electrum@90fe308"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/117xxx/CVE-2026-117601.json"},{"type":"FIX","url":"https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb"},{"type":"ADVISORY","url":"https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117601"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:54:50.444235873Z"}}