{"id":"CVE-2026-117601","published":"2026-10-27T14:16:39.947","lastModified":"2026-10-27T16:03:45.247","description":"Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb","tags":[]},{"url":"https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v","tags":[]},{"url":"https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions","tags":[]}],"exploitRefs":[{"url":"https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb","tags":[]},{"url":"https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v","tags":[]}],"hasPoc":true,"ai":null}