Read the docs
TI-2026-46466 Aliases CVE-2026-65058GHSA-6552-m3hr-mqwj

Trezor Safe improper security check in on-device display

Priority LOW 27CWE-358Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata to a victim then supply a different tail that changes the signed transaction. Fixed in 70c9b0c.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Fixed Safe 3 (Trezor): 70c9b0cSafe 7 (Trezor): 70c9b0c+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TrezorSafe 3before 70c9b0c70c9b0cPatch availableCNA
TrezorSafe 7before 70c9b0c70c9b0cPatch availableCNA
TrezorSafe 5before 70c9b0c70c9b0cPatch availableCNA
  • Safe 3 VendorTrezor Affected before 70c9b0c Fixed in 70c9b0c Patch available CNA
  • Safe 7 VendorTrezor Affected before 70c9b0c Fixed in 70c9b0c Patch available CNA
  • Safe 5 VendorTrezor Affected before 70c9b0c Fixed in 70c9b0c Patch available CNA

Remediation

  • Fix · CNA Safe 3 (Trezor) Fixed in 70c9b0c
  • Fix · CNA Safe 7 (Trezor) Fixed in 70c9b0c
  • Fix · CNA Safe 5 (Trezor) Fixed in 70c9b0c

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65058
  2. 2026-10-03 Alias added: GHSA-6552-m3hr-mqwj

References

Patch 1

Advisory 1

Other 1

  • TI-2020-13336 A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27… CVSS 3.1CRITICAL 9.8
  • TI-2019-10697 On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was… CVSS 3.0MEDIUM 4.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences