CVE-2023-7345Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation
Updated under an hour ago ()
Does this affect you?
It affects ledgerhq/hw-app-eth and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers at incorrect amounts.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-704
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Jul 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Ledger ledgerhq/hw-app-eth ledger:ledgerhq_hw_app_eth (from the name) | before 6.34.7 | CNA record |
Ledger Ledger Live ledger:live (from the name) | before 2.70.0 | CNA record |
References
- https://donjon.ledger.com/lsb/020/vendor-advisory
- https://www.vulncheck.com/advisories/ledger-live-hw-app-eth-eip-712-message-parsing-integer-truncationthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.