Electrum - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/electrum/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 15:50:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgElectrum: Unverified signature vulnerability in mempool transactions (CVE-2026-117601)https://feed.craftedsignal.io/briefs/2026-10-electrum-sig-verification/Tue, 27 Oct 2026 15:50:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-electrum-sig-verification/Electrum versions prior to 4.8.3 fail to verify signatures of wallet-owned inputs in unconfirmed transactions, allowing malicious servers to trick users into signing fraudulent fee-replacement transactions.Electrum versions before 4.8.3 contain a vulnerability (CVE-2026-117601) where the client fails to verify the signatures of wallet-owned inputs for transactions residing in the unconfirmed mempool. This flaw allows a malicious server to intercept and replace a broadcast transaction with a conflicting one.

Impact

Attackers can manipulate the user's view of pending transactions, suppressing the original broadcast and presenting a modified, invalid zero-fee version that pays an attacker-controlled address. By presenting this as a transaction that requires an RBF (Replace-By-Fee) bump, the attacker tricks the user into signing a transaction that transfers funds to the attacker.

Recommendation

  • Upgrade Electrum clients to version 4.8.3 or later on all systems where the wallet software is installed.
  • Until patching is complete, verify all RBF requests against the intended recipient address and fee structure before signing transactions.
  • For enterprise or high-value environments, isolate Electrum instances to connect only to trusted, verified Electrum servers rather than relying on auto-discovered or public nodes.
]]>highadvisory