Are non-SegWit transactions still malleable?

Question

SegWit was (amongst other improvements) introduced to fix malleability issues. Does that mean that non-SegWit transactions are still malleable? If so, what types of malleability could still happen in practice?

Answer 1

It's important to point out that segwit doesn't prevent malleability: in many ways the actual transaction data can still be changed by third parties. It just makes it harmless for the purposes of dependant transactions/higher level protocols, because when malleated, the resulting transaction will still have the same txid as the original.

To get this protection however, all transaction inputs must be segwit. As old style inputs by definition must be compatible with non-segwit software, their signature will contribute to the txid just as before.

Answer 2

Does that mean that non-SegWit transactions are still malleable?

Yes. Segwit does not change non-segwit inputs so the malleability fixes it introduces only apply to segwit inputs.

If so, what types of malleability could still happen in practice?

All of them (except the ones where the sender modifies the transaction himself). None of these are consensus rules so a miner could malleate a transaction in any of these ways.