Electrum CVE-2026-117603

Exploitation requires all of: (1) the built-in Nostr Wallet Connect plugin is enabled - it is default-disabled; (2) a daily_limit_sat is configured (that limit is exactly what is bypassed); (3) the attacker controls a client holding a valid NWC connection that the user issued; and (4) Electrum version in the range 4.6.0 ≤ x < 4.7.2. Two concrete trigger paths exist: the race path needs two or more pay_invoice requests sent concurrently on the same connection so both pass budget_allows_spend() before add_to_budget() runs, and the truncation path needs repeated zero-amount invoices specifying sub-satoshi millisatoshi amounts (e.g. amount=1999 msat) that invoice.get_amount_sat() floors to a smaller whole-sat figure. Limiting factors that reduce real-world risk: the plugin is off by default, a valid user-granted NWC connection is mandatory, and the attack only matters when the connected client is untrusted (e.g. a paid billing service) rather than a trusted app such as Amethyst; the race path also depends on winning a concurrency window, though the truncation path is deterministic.

The vendor CVSS 4.0 base score is 9.3 (Critical) with AV:N/AC:L/AT:N/PR:N/UI:N and VC:H/VI:H/VA:H, and vuln.today assigns the decision label act_now, so on paper this is top-priority. However the signals should be read against the actual mechanism. This is CWE-367 (TOCTOU) - a daily spending-limit bypass in the built-in Nostr Wallet Connect (NWC) plugin - and three facts temper the raw score: (1) the NWC plugin is a default-disabled built-in plugin, so only wallets that explicitly enabled it and configured a daily_limit_sat are exposed; (2) exploitation fundamentally requires the attacker to already hold a valid, user-issued NWC connection, which is an authorization precondition the vendor's PR:N does not reflect - I assess PR:L; and (3) the vendor rates confidentiality VC:H, but this flaw causes unauthorized spending (loss of funds), not data disclosure, so confidentiality impact is realistically None and the true impact is integrity/availability of wallet funds. No CISA KEV listing and no EPSS score are present in the input, and no active exploitation is claimed, so the act_now label is driven by patch availability plus direct financial impact rather than by observed in-the-wild activity. Net: a genuine, patch-now financial-integrity bug for the specific population running the NWC plugin with an untrusted client, but the blast radius is narrower than the unauthenticated 9.3 implies - verify the PR:N vs PR:L discrepancy and the VC:H rating against the vendor advisory.

An untrusted but validly connected NWC client - for example a paid on-demand billing service like ppq.ai that the user authorized - fires two concurrent pay_invoice requests of 1000 sat each against a wallet configured with daily_limit_sat=1000; both requests pass budget_allows_spend() before either call to add_to_budget() runs, so 2000 sat is spent. Alternatively the client repeatedly pays zero-amount invoices specifying amount=1999 msat, which the budget logic floors to 1 sat while actually spending ~2 sat, slowly draining funds past the configured policy. No packaged exploit tool is referenced in the input, but the vendor GHSA advisory publicly documents step-by-step reproduction for both bypass techniques.