CVE-2026-117601: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

The main Electrum server the client connects to is trusted with mempool (“unconfirmed”) transactions. This is documented design. [0]

However now someone figured out a way to practically exploit it:

• when the client broadcasts a new tx1, a malicious server can swallow it,
• and update the client’s history with a conflicting (invalid) tx2 that replaces the outputs with the attacker’s output address.
• Tx2 has invalid signatures, but this is not checked (due to light client design).
• The wallet will display tx2 as an unconfirmed transaction - tx1 will not be displayed.
• If the client then manually RBF fee-bumps tx2, the client will sign it with a higher fee, and hence pay the attacker.