CVE-2023-7345

The record

Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers at incorrect amounts.

Affected packages

Related vulnerabilities

• CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-704
• CVE-2026-10080 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to… CWE-704
• CVE-2026-15826 The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via… CWE-704
• CVE-2026-53798 rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… CWE-704
• CVE-2026-73429 Russh is a Rust SSH client & server library. CWE-704
• CVE-2026-18675 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the… CWE-704
• CVE-2026-6726 An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that… CWE-704
• CVE-2026-50337 Incorrect type conversion or cast in Windows Notification allows an authorized attacker… CWE-704