CVE-2023-7346: Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-20 · updated 2026-07-23
Weakness: CWE-682

Description

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Affected products

Ledger Bitcoin app: 2.1.0, 2.1.1

References

https://donjon.ledger.com/lsb/019/
https://www.vulncheck.com/advisories/ledger-bitcoin-app-address-derivation-error-via-miniscript

Get alerted when CVE-2023-7346 or the next vulnerability affects your stack