Vulnerabilities CVE-2023-7346

CVE-2023-7346

Medium

Open

TLP:CLEAR

Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Details

CVSS Score: 4.0
EPSS Score ⓘ: 0.14%

3.9th percentile
CVSS Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Confidence: 90%
Published: May 20, 2026
Last Modified: Aug 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.