CVE-2023-7346

4.0 MEDIUM

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin ...

Published: 2026-05-20 · Last updated: 2026-05-20

Severity and scoring

CVSS: 4.0 MEDIUM
Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE: CWE-682

Description

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-44074 — Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error cond... (3.7 LOW)
CVE-2026-7836 — An incorrect calculation in the hextoint macro in Netatalk 2.0.0 through 4.4.2 due to improper uppercase character handling allows a remo... (3.1 LOW)
CVE-2025-5372 — A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for ke... (5.0 MEDIUM)