Signature Verification Flaw in Electrum Wallet by Spesmilo

CVE-2026-117601

What is CVE-2026-117601?

The Electrum wallet prior to version 4.8.3 contains a significant flaw regarding the verification of signatures in unconfirmed mempool transactions. This vulnerability permits malicious actors to exploit the Electrum wallet by substituting a legitimate transaction with a malicious one. By failing to verify the signatures of wallet-owned inputs, the wallet may inadvertently endorse a conflicting transaction, leading users to believe they have successfully broadcast their transaction. In such scenarios, an attacker can present an invalid, zero-fee version of the transaction directed to their own address, compelling users to unintentionally sign and propagate it through a fee-bumping process. This not only leads to financial loss but also undermines the trust placed in the Electrum wallet.

References