electrum vulnerabilities

2 known vulnerabilities in electrum from Spesmilo. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.4 High severity

  electrum: Improper Verification of Cryptographic Signature

  CVE-2026-117602Oct 27, 2026Spesmilo

  Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local proces

• 7.5 High severity

  electrum: Improper Verification of Cryptographic Signature

  CVE-2026-117601Oct 27, 2026Spesmilo

  Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an