Electrum: Unverified signature vulnerability in mempool transactions (CVE-2026-117601)

Electrum versions before 4.8.3 contain a vulnerability (CVE-2026-117601) where the client fails to verify the signatures of wallet-owned inputs for transactions residing in the unconfirmed mempool. This flaw allows a malicious server to intercept and replace a broadcast transaction with a conflicting one.

Impact

Attackers can manipulate the user's view of pending transactions, suppressing the original broadcast and presenting a modified, invalid zero-fee version that pays an attacker-controlled address. By presenting this as a transaction that requires an RBF (Replace-By-Fee) bump, the attacker tricks the user into signing a transaction that transfers funds to the attacker.

Recommendation

• Upgrade Electrum clients to version 4.8.3 or later on all systems where the wallet software is installed.
• Until patching is complete, verify all RBF requests against the intended recipient address and fee structure before signing transactions.
• For enterprise or high-value environments, isolate Electrum instances to connect only to trusted, verified Electrum servers rather than relying on auto-discovered or public nodes.