CVE-2026-117601
Description
A flaw was found in electrum. A connected malicious server can exploit this vulnerability to cause theft of funds by replacing a legitimate transaction with a fraudulent transfer. Because the application fails to verify cryptographic signatures on unconfirmed transactions, the attacker can display a spoofed transaction paying an attacker-controlled address. This issue allows the server to deceive the user into signing a fee adjustment, resulting in the unauthorized transfer of funds.
Statement
This vulnerability affects the Electrum package shipped in Fedora. No other Red Hat products are affected. Exploitation requires a malicious Electrum server and the user subsequently fee-bumping and signing a substituted transaction, potentially transferring funds to an attacker.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce cryptographic signature verification on wallet-owned inputs for incoming mempool transactions before adding them to the wallet history: upgrade to Electrum 4.8.3 (or the fixed Electrum builds), which verify cryptographic signatures of wallet-owned inputs in incoming transactions before adding them to the database and reject invalid transactions, closing all 3 injection vectors (malicious Electrum server response, spoofed unconfirmed mempool transaction injection, fraudulent Replace-By-Fee (RBF) fee bump). Until patched, this is a concern on Electrum users connecting to untrusted or compromised servers across any platform, so connect only to trusted Electrum servers and carefully verify output destination addresses and amounts prior to signing Replace-By-Fee adjustments. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing cryptographic signature verification defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
