Electrum versions prior to 4.8.3 do not verify the signatures of wallet‑owned inputs in unconfirmed mempool transactions. This flaw allows an attacker who controls or compromises a server to replace a user’s broadcast transaction with a conflicting one. By broadcasting a zero‑fee copy that pays an attacker address, the server can entice the user to perform a replace‑by‑fee (RBF) bump, causing the user to sign and submit a transaction that transfers funds to the attacker.

The vulnerability affects the Electrum wallet distributed by Specmilo. All releases before version 4.8.3 are vulnerable; version 4.8.3 and later include the signature verification fix.

The CVSS score of 9.3 indicates a high severity. EPSS data is not available, so the current exploitation probability is unknown, but the lack of signature validation makes local and remote exploitation likely as soon as a malicious or untrusted server is contacted. The vulnerability is not listed in the CISA KEV catalog, yet the attack does not require a sophisticated payload—any compromised or malicious Electrum server can perform the transaction swap. The likely attack vector is a server‑side substitution of mempool transactions that the client accepts without verification.