CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
CriticalCVSS 9.3
EPSS 0.19%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| spesmilo electrum | < 4.7.2 | 4.7.2 |
| debian/electrum(Debian:14) | < 4.8.1+dfsg-1 | 4.8.1+dfsg-1 |
| debian/electrum(Debian:14) | = 4.5.8+ds-6 | No fix listed |
| debian/electrum(Debian:14) | = 4.5.8+ds-7 | No fix listed |
| debian/electrum(Debian:14) | = 4.5.8+ds-8 | No fix listed |
| debian/electrum(Debian:14) | = 4.6.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.6.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:14) | = 4.6.2+dfsg-2~bpo13+1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.0+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.0+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.0+dfsg2-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.1+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.2+dfsg-1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.2+dfsg-1~bpo13+1 | No fix listed |
| debian/electrum(Debian:14) | = 4.7.2+dfsg-2 | No fix listed |
| debian/electrum(Debian:14) | = 4.8.1+dfsg-1~bpo13+1 | No fix listed |
References
- GitHub Security Advisory (GHSA-q7m2-785w-r585) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass third-party-advisory
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2561978 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-117603 vendor-advisory