CVE-2023-7345 Ledger CVE debrief

Who should care

Ledger Live users, developers, and operators of applications that embed or depend on ledgerhq/hw-app-eth prior to 6.34.7; teams that rely on EIP-712 typed data signing for blockchain approvals; security teams reviewing hardware-wallet transaction validation flows.

Technical summary

The vulnerability is an integer parsing / hex-field handling issue in ledgerhq/hw-app-eth prior to 6.34.7. According to the supplied description, odd-length hexadecimal values in EIP-712 typed data can be parsed incorrectly, causing the displayed or signed value to differ from the intended message. That can let an attacker obtain a signature over truncated or misread data and potentially authorize unintended transfers or other on-chain actions.

Defensive priority

Medium. The impact can be financially significant because it affects signing trust, but the issue requires user interaction and the supplied CVSS severity is medium (6.9). Prioritize remediation in any environment that uses Ledger Live or the affected library for transaction approval.

Recommended defensive actions

• Update ledgerhq/hw-app-eth to version 6.34.7 or later.
• Verify that Ledger Live and any downstream applications are not bundling a vulnerable copy of ledgerhq/hw-app-eth.
• Review lockfiles, package manifests, and supply-chain dependencies for the affected library version.
• Treat EIP-712 signing prompts with extra verification until all affected components are updated.
• If your workflow depends on hardware-wallet approvals, confirm the values shown to users are fully validated before signing.

Evidence notes

The supplied CVE description states that Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability affecting EIP-712 typed data when hexadecimal fields have an odd number of characters. The supplied NVD metadata marks the record as Deferred and cites two references: a Ledger disclosure page and a VulnCheck advisory. Timing context from the provided timeline shows the CVE published on 2026-05-19 and modified on 2026-05-20.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.