Ledger discloses vulnerability details: Screen-displayed parameters may be inconsistent with final signature parameters.

Ledger disclosed details of the LSB 023 security vulnerability on its official website yesterday. Applications built partially on the Ledger Secure SDK may still receive new APDU commands while users complete screen confirmation, resulting in a mismatch between parameters displayed on the screen and those used for the final signature. If an attacker controls APDU communication between the device and host, after a user confirms the operation shown on the screen, the device may generate a signature for different parameters. Ledger noted that it has fixed the issue via application-level checks and SDK layer patches, releasing Ledger Secure SDK v26.6.1 on August 21. Related applications have been rebuilt and re-released. Users must update the applications via Ledger Live; updating only the device firmware is insufficient to resolve the flaw. However, Ledger added there is currently no evidence that the vulnerability has been exploited in real-world scenarios.