Read the docs
TI-2023-06710 Aliases CVE-2023-7346GHSA-329m-69cj-4486

Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript

Priority LOW 18CWE-682Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Fix Fixed Ledger Bitcoin app (Ledger): 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LedgerLedger Bitcoin app2.1.0; 2.1.12.1.2Patch availableCNA
  • Ledger Bitcoin app VendorLedger Affected 2.1.0; 2.1.1 Fixed in 2.1.2 Patch available CNA

Remediation

  • Fix · CNA Ledger Bitcoin app (Ledger) Fixed in 2.1.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-7346
  2. 2026-10-03 Alias added: GHSA-329m-69cj-4486

References

Advisory 1

  • TI-2017-02028 Memory corruption in Ledger CLI CVSS 3.0HIGH 7.8
  • TI-2017-02029 Use after free in Ledger CLI CVSS 3.0HIGH 7.8
  • TI-2020-09753 Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). CVSS 3.1HIGH 8.1
  • TI-2023-06709 Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation CVSS 4.0MEDIUM 6.9
  • TI-2020-05566 A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger… CVSS 3.1MEDIUM 5.5
  • TI-2025-14269 Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service CVSS 4.0MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences