CVE-2023-7346 - CVE House
Back to Database
Status published Medium CVE-2023-7346

Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript

Vulnerability Description

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-7346

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Kevin Loaec
  • Antoine Poinsot
  • VulnCheck

References

More from Ledger

View All →
CVE-2025-15645
Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service
Medium 5.1
CVE-2023-7345
Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation
Medium 6.9
CVE-2017-2808
An exploitable use-after-free vulnerability exists in the account parsing component...
High 7.5
CVE-2017-2807
An exploitable buffer overflow vulnerability exists in the tag parsing...
High 7.5

Affected Vendor

Affected Software

Ledger Bitcoin app
Vulnerable Versions:
2.1.0, 2.1.1, 2.1.2

Timeline

Official Publish: May 20th, 2026
Last Modified: May 20th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-682

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.