Ledger Discloses Security Vulnerability in Secure SDK

KuCoinFlash

Release Time: 2026/08/28 00:34:27

LDO

$0.38263.82%

Summary

On August 28, 2026, Ledger disclosed a security vulnerability in its Secure SDK via LSB 023. The issue involved a flaw where APDU commands could be modified during user confirmation, resulting in mismatched signed data. Ledger addressed the vulnerability with application-level checks and released SDK v26.6.1 on August 21. All affected applications have been updated and published. Users are strongly encouraged to update via Ledger Live, as firmware updates alone are insufficient. Ledger has found no evidence of exploitation.

BlockBeats report: On August 28, Ledger disclosed details of the LSB-023 security vulnerability on its official website. Applications built on the Ledger Secure SDK may still receive new APDU commands during user screen confirmation, resulting in a discrepancy between the parameters displayed on the screen and those used for the final signature. Under conditions where an attacker controls the APDU communication between the device and host, the device may generate a signature for different parameters after the user confirms the operation shown on the screen.

Ledger indicates that the issue has been resolved at the application-level checksum and SDK layer, and released Ledger Secure SDK v26.6.1 on August 21, with affected applications rebuilt and republished. Users must update their applications via Ledger Live; updating the device firmware alone is insufficient to resolve the issue. However, Ledger states there is currently no evidence that this vulnerability has been exploited in practice.

Source:Show original

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.