CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
CriticalCVSS 9.3
EPSS 0.18%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi electrum(PyPI) | < 4.8.3 | 4.8.3 |
| pypi electrum(PyPI) | = 0 | No fix listed |
| spesmilo electrum | < 4.8.3 | 4.8.3 |
| debian/electrum(Debian:12) | All versions | No fix listed |
| debian/electrum(Debian:12) | = 4.3.4+dfsg1-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.3.4+dfsg1-1+deb12u1 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.5+dfsg1-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.5+dfsg1-1~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.5+dfsg1-2 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.5+dfsg1-3 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.5+dfsg1-3~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.6+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.6+dfsg-1~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.6+dfsg2-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.4.6+dfsg2-1~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.2+dfsg-2~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.4+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.4+dfsg-1~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.4+dfsg-2 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.4+dfsg-3 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.4+dfsg-3~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.5+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.5+dfsg-1~bpo12+1 | No fix listed |
Show 61 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/electrum(Debian:12) | = 4.5.5+dfsg-2 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.5+dfsg-3 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.5+dfsg-4 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.5+dfsg-4~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-1~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-2 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-3 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-3~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-4 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-5 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-5~bpo12+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-6 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-7 | No fix listed |
| debian/electrum(Debian:12) | = 4.5.8+ds-8 | No fix listed |
| debian/electrum(Debian:12) | = 4.6.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.6.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:12) | = 4.6.2+dfsg-2~bpo13+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.7.0+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.7.0+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.7.0+dfsg2-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.7.1+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.7.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.7.2+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.7.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:12) | = 4.8.1+dfsg-1 | No fix listed |
| debian/electrum(Debian:12) | = 4.8.1+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:12) | = 4.8.3+dfsg-1 | No fix listed |
| debian/electrum(Debian:13) | All versions | No fix listed |
| debian/electrum(Debian:13) | = 4.5.8+ds-6 | No fix listed |
| debian/electrum(Debian:13) | = 4.5.8+ds-7 | No fix listed |
| debian/electrum(Debian:13) | = 4.5.8+ds-8 | No fix listed |
| debian/electrum(Debian:13) | = 4.6.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:13) | = 4.6.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:13) | = 4.6.2+dfsg-2~bpo13+1 | No fix listed |
| debian/electrum(Debian:13) | = 4.7.0+dfsg-1 | No fix listed |
| debian/electrum(Debian:13) | = 4.7.0+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:13) | = 4.7.0+dfsg2-1 | No fix listed |
| debian/electrum(Debian:13) | = 4.7.1+dfsg-1 | No fix listed |
| debian/electrum(Debian:13) | = 4.7.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:13) | = 4.7.2+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:13) | = 4.7.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:13) | = 4.8.1+dfsg-1 | No fix listed |
| debian/electrum(Debian:13) | = 4.8.1+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:13) | = 4.8.3+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | < 4.8.3+dfsg-1 | 4.8.3+dfsg-1 |
| debian/electrum(Debian:14) | = 4.5.8+ds-6 | No fix listed |
| debian/electrum(Debian:14) | = 4.5.8+ds-7 | No fix listed |
| debian/electrum(Debian:14) | = 4.5.8+ds-8 | No fix listed |
| debian/electrum(Debian:14) | = 4.6.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.6.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:14) | = 4.6.2+dfsg-2~bpo13+1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.0+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.0+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.0+dfsg2-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.1+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.2+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:14) | = 4.8.1+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.8.1+dfsg-1~bpo13+1 | No fix listed |
References
- GitHub Security Advisory (GHSA-6jp4-8v48-cc5v) vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- Patch Commit patch
- github.com product
- www.binance.com
- VulnCheck Advisory: Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions third-party-advisory
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2561987 issue-tracking
- www.cve.org
- Debian Security Tracker CVE-2026-117601 vendor-advisory
- github.com
- bugs.debian.org issue-tracking