{"cvss":9.3,"datePublished":"2026-10-27T00:00:00Z","dateUpdated":"2026-10-27T00:00:00Z","description":"Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.","dueDate":"","id":"CVE-2026-117601","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Electrum","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"electrum electrum Improper Verification of Cryptographic Signature","vendor":"spesmilo"}