CVE-2026-117601 in Electrum
الملخص
بحسب MITRE • 27/10/2026
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.