CVE-2026-65058 Trezor CVE debrief

Who should care

Users of Trezor Safe 3, Safe 5, and Safe 7 devices should verify their firmware versions and update to the latest version if necessary. Additionally, security teams and vulnerability management teams should review the vulnerability and assess their exposure. Operators of affected systems should also review the vulnerability and take necessary actions to mitigate potential attacks.

Technical summary

The Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata to a victim then supply a different tail that changes the signed transaction. The vulnerability was fixed in firmware version 70c9b0c. Affected users should verify their firmware versions and update to the latest version if necessary.

Defensive priority

Medium priority due to the potential for attackers to manipulate transaction data.

Recommended defensive actions

• Verify firmware versions and update to the latest version if necessary
• Implement additional security measures to monitor and validate transaction data
• Consider using compensating controls to mitigate potential attacks
• Review and validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and analysis are necessary to fully understand the impact and potential mitigations. Affected product deployments should be verified for exposure, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Compensating controls may be necessary for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.