CVE-2026-117601

Name of the Vulnerable Software and Affected Versions Electrum versions prior to 4.8.3

Description The software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This allows malicious servers to replace a recently broadcast transaction with a conflicting one. Attackers can suppress the original transaction and present an invalid zero-fee copy that pays an attacker-controlled address, potentially tricking users into performing a Replace-By-Fee (RBF) fee-bump and signing the malicious transaction.

Recommendations Update to version 4.8.3.