cyfenced.com →

[ CVE-2026-117601 · Published 27 Oct 2026 ]

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

CVSS 7.5 EPSS <1%Fix available

[ Description ]Official description

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

[ Fixes ]Fixes and patches

  • electrum 4.8.3Fixed version · GitHub Advisories · pip package electrum: upgrade to 4.8.3 or later (affected < 4.8.3)

[ Packages ]Affected open-source packages

[ References ]References