CVE-2026-117601

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://nvd.nist.gov/vuln/detail/CVE-2026-117601

Full discourse1 post

Eliran Emuna@EmunaEliran23h
🚨 Electrum wallet: 2 CVEs, CVSS 4.0 9.3 (CNA) ⚠️ CVE-2026-117601: malicious server can swap your tx for a zero-fee copy paying the attacker ⚠️ CVE-2026-117603: NWC spending limit bypass ✅ Update to 4.8.3+ 🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-117601 #Bitcoin #CyberSecurity https://t.co/oUGeEr28Di
0000032
76 followersView on X

Explore more

Back to dashboard