CVE-2023-7345 - CVE House
Back to Database
Status published Medium CVE-2023-7345

Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation

Vulnerability Description

Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers at incorrect amounts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-7345

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ian Fisher
  • VulnCheck

References

More from Ledger

View All →
CVE-2025-15645
Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service
Medium 5.1
CVE-2023-7346
Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript
Medium 4.1
CVE-2017-2808
An exploitable use-after-free vulnerability exists in the account parsing component...
High 7.5
CVE-2017-2807
An exploitable buffer overflow vulnerability exists in the tag parsing...
High 7.5

Affected Vendor

Affected Software

ledgerhq/hw-app-eth, Ledger Live
Vulnerable Versions:
0

Timeline

Official Publish: May 19th, 2026
Last Modified: July 15th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-704

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.