# CVE-2026-117601: Electrum signature verification bypass in mempool transactions

Source: https://junglewise.ai/threats/cve-2026-117601-electrum-before-4-8-3-fails-to-verify-signatures-of-wallet-owned  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117601 · Severity: high · CVSS 7.5 · Published 2026-10-27

Electrum, a Bitcoin wallet application, failed to verify transaction signatures for unconfirmed mempool transactions before version 4.8.3. A malicious server could intercept and replace a user's broadcast transaction with a fake one paying the attacker, which the wallet would display as legitimate. When users attempt to increase fees on this fraudulent transaction, they unknowingly sign it with higher fees and send funds to the attacker.

Technologies: [Electrum](https://junglewise.ai/threats/technologies/electrum). Vendors: [Electrum](https://junglewise.ai/threats/vendors/electrum), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-117601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117601 being exploited in the wild.

**How severe is CVE-2026-117601?** High severity, with a CVSS score of 7.5, published 27 October 2026.

**Which products and versions are affected?** Electrum before 4.8.3; electrum (PyPI) < 4.8.3, ECOSYSTEM:introduced=0,fixed=4.8.3.

**Is there a fix for CVE-2026-117601?** Yes. electrum (PyPI): upgrade to 4.8.3 or later. Until then: As a workaround without upgrading, users should carefully verify output addresses and amounts match their intent before signing any transaction, whether for fee-bumping or initial broadcast. Users running their own Electrum server are not affected by this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117601 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-117601?** Check whether you run Electrum or electrum (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electrum (PyPI): upgrade to 4.8.3 or later

  ```sh
  pip install "electrum>=4.8.3"
  ```


As a workaround without upgrading, users should carefully verify output addresses and amounts match their intent before signing any transaction, whether for fee-bumping or initial broadcast. Users running their own Electrum server are not affected by this vulnerability.

## Technical details

The vulnerability stems from Electrum's light client design, which does not verify signatures for unconfirmed (mempool) transactions received from servers. An attacker operating a malicious Electrum server can intercept a broadcasted transaction, swallow it, and inject a conflicting transaction with identical outputs except redirected to the attacker's address. Users are tricked into fee-bumping the invalid transaction via RBF (Replace-By-Fee), unknowingly signing and sending funds to the attacker. The fix verifies signatures of wallet-owned inputs for unconfirmed transactions before adding them to local history.

## Affected products

- Electrum Electrum before 4.8.3

## Identifiers

- CVE-2026-117601
- GHSA-6jp4-8v48-cc5v

## Timeline

- 2026-10-11: disclosed: Initial private disclosure from user1
- 2026-10-18: other: user2 (Raju-K12) reports private disclosure of exploitation in the wild with financial loss
- 2026-10-23: patched: Version 4.8.3 tagged with fix
- 2026-10-24: advisory: Version 4.8.3 binaries released and public disclosure
- 2026-10-18: exploited: Evidence of exploitation in the wild from user reports

## References

- [https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb](https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb)
- [https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v](https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v)

## Related threats

- [Electrum spending limit bypass in Nostr Wallet Connect plugin](https://junglewise.ai/threats/cve-2026-117603-electrum-before-4-7-2-contains-a-spending-limit-bypass)
- [Electrum authorization bypass in external plugin loader](https://junglewise.ai/threats/cve-2026-117602-electrum-4-6-0-before-4-7-2-contains-an-authorization-bypass-in)