DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-117601: CVE-2026-117601: Improper Cryptographic Signature Verification in Electrum Bitcoin Wallet

#security #cve #cybersecurity

CVE-2026-117601: Improper Cryptographic Signature Verification in Electrum Bitcoin Wallet

Vulnerability ID: CVE-2026-117601
CVSS Score: 9.3
Published: 2026-10-28

A missing cryptographic signature verification vulnerability exists in Electrum Bitcoin Wallet versions prior to 4.8.3. In Electrum's Simplified Payment Verification (SPV) architecture, the client failed to validate input signatures on unconfirmed mempool transactions received from connected Electrum servers. A malicious Electrum server can exploit this flaw by intercepting a legitimate user broadcast, suppressing it, and returning a spoofed unconfirmed transaction with an invalid signature and zero fee that redirects the user's UTXOs to an attacker-controlled address. When the user initiates a Replace-By-Fee (RBF) action to accelerate the seemingly stuck transaction, Electrum signs the spoofed outputs with the user's private keys, resulting in the direct theft of funds.

TL;DR

Electrum Bitcoin Wallet versions prior to 4.8.3 fail to verify cryptographic signatures on wallet-owned inputs for unconfirmed transactions received from Electrum servers. A malicious server can inject a spoofed, zero-fee mempool transaction spending the user's funds to an attacker address and induce the user to sign it via a Replace-By-Fee (RBF) fee bump.

Technical Details

  • Vulnerability ID: CVE-2026-117601 / GHSA-6jp4-8v48-cc5v
  • CWE Classification: CWE-347: Improper Verification of Cryptographic Signature
  • CVSS v4.0 / v3.1 Score: 9.3 (Critical) / 7.5 (High)
  • EPSS Score: 0.18% (7.12th Percentile)
  • Attack Vector: Network (Malicious Electrum Server / SPV Protocol Manipulation)
  • Affected Versions: Electrum < 4.8.3
  • Patched Version: Electrum 4.8.3
  • Primary Impact: Theft of Bitcoin funds via Replace-By-Fee (RBF) transaction poisoning

Affected Systems

  • Electrum Bitcoin Wallet (spesmilo/electrum)
  • Electrum Bitcoin Wallet: < 4.8.3 (Fixed in: 4.8.3)

Code Analysis

Commit: 90fe308

Merge "verify_sigs": adb: check sigs of is_mine txins of unconf txs (verify signatures of wallet.is_mine inputs for mempool txs only)

Mitigation Strategies

  • Upgrade Electrum Bitcoin Wallet to version 4.8.3 or later to enforce local cryptographic signature verification on mempool inputs.
  • Connect exclusively to a trusted, self-hosted Electrum server (Fulcrum, ElectrumX, or Electrs) backed by a personal full node using the --oneserver configuration flag.
  • Verify destination addresses and output amounts on a hardware wallet's trusted display prior to approving any Replace-By-Fee (RBF) or fee-bumping transaction.
  • Avoid relying on unconfirmed (0-conf) transaction states for automated financial workflows or point-of-sale systems.

Remediation Steps:

  1. Download the official Electrum 4.8.3 (or newer) release package from the official project repository or website.
  2. Verify the GPG signature of the downloaded Electrum binary or source tarball against the maintainers' public keys.
  3. Install the updated version and restart any running Electrum GUI or headless daemon instances.
  4. In Electrum Network Settings (Tools -> Network), optionally disable 'Select server automatically' and configure a known trusted server endpoint.

References

Read the full report for CVE-2026-117601 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)