CVE-2026-117601

7.5 HIGHpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-347

Public exploit & PoC references

https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb
https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v

All references

https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb
https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-71422PoC
HIGHCVE-2026-100293
CRITICALCVE-2026-10141
HIGHCVE-2026-102266PoC
CRITICALCVE-2026-102268PoC
HIGHCVE-2026-102271PoC
HIGHCVE-2026-102272PoC
HIGHCVE-2026-102273PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.