According to Huoxing Finance, on August 28, Ledger disclosed details of the LSB-023 security vulnerability on its official website. Applications built on the Ledger Secure SDK may still receive new APDU commands during user screen confirmation, resulting in a discrepancy between the parameters displayed on the screen and those used for the final signature. Under conditions where an attacker controls the APDU communication between the device and host, the device may generate a signature for different parameters after the user confirms the operation shown on the screen. Ledger stated that the issue has been resolved through application-level validation and SDK-level fixes, with Ledger Secure SDK v26.6.1 released on August 21; related applications have been rebuilt and republished. Users must update their applications via Ledger Live, as updating only the device firmware is insufficient to fully resolve the issue. However, Ledger noted there is currently no evidence that this vulnerability has been exploited in practice.
Ledger Discloses LSB 023 Vulnerability: Displayed Parameters May Differ from Signed Parameters
MarsBitShare
Summary
On August 28, 2026, Ledger disclosed a new vulnerability, LSB-023. Certain apps using the Ledger Secure SDK could receive new APDU commands during user confirmation, causing a mismatch between parameters displayed on the device and those signed. Ledger resolved the issue at both the app and SDK levels, releasing version 26.6.1 on August 21. All affected apps have been updated and published. Users must update via Ledger Live—updating firmware alone is insufficient. Ledger stated there is no evidence the vulnerability has been exploited. On-chain developments continue to emphasize security updates across the cryptocurrency ecosystem.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.