12 matches found
EUVD-2026-110850
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it...
GHSA-6JP4-8V48-CC5V Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
Summary The main Electrum server the client connects to is trusted with mempool "unconfirmed" transactions. This is documented design. 0 However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, - and update the...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
Linux Distros Unpatched Vulnerability : CVE-2026-117601
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
Spesmilo Electrum encryption issue vulnerability
Versions of spesmilo electrum prior to 4.8.3 contain an encryption-related vulnerability. This flaw arises from the failure to validate the signature of inputs provided by wallets during unverified memory pool transactions. As a result, malicious servers can replace newly broadcast transactions...
VulnCheck KEV: CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
PT-2026-126431
Name of the Vulnerable Software and Affected Versions Electrum versions prior to 4.8.3 Description The software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This allows malicious servers to replace a recently broadcast transaction with a conflicting one...
Bitcoin Core PreChecks Authentication
The vulnerability of the PreChecks functionality in the standard Bitcoin Bitcoin Core implementation is related to the incorrect replacement of the child transaction. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service failures...