CVE-2026-117602
Description
A flaw was found in Electrum. The external plugin loader does not verify authorization signatures before executing enabled plugins. A local attacker with write access to the application data directory can place malicious plugin code into the plugins folder and enable it in the configuration file. This flaw allows the attacker to achieve arbitrary code execution within the running Electrum process.
Statement
This vulnerability is rated as Important because local unauthorized code execution within the user's running application context could compromise sensitive wallet data without requiring elevated system privileges. While exploitation requires existing write permissions to the application's configuration storage, the failure to enforce cryptographic verification allows an unprivileged local attacker or process to completely take over the application environment. Electrum is not distributed or supported within Red Hat Enterprise Linux, limiting exposure strictly to users of Fedora community packages.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
