CVE-2023-7346

The record

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Affected packages

Related vulnerabilities

• CVE-2026-53670 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-54754 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-682
• CVE-2026-76043 Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote… CWE-682
• CVE-2026-20763 Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within… CWE-682
• CVE-2026-55597 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-682
• CVE-2026-10512 The X25519 x86_64 assembly implementation fails to clear the most significant bit during… CWE-682