Ledger Ethereum app clear-signing bypass hid all but one operation of a large batch

Ledger’s security bulletin LSB-024 describes a clear-signing bypass in the Ethereum app’s Generic Transaction Parser. According to Ledger, the parser stored an attacker-controlled 16-bit array element count in an 8-bit field, so counts above 255 wrapped around: a 257-element array was recorded as 1, the device displayed a single operation, and the signature covered the whole batch.

Ledger states that exploitation requires a compromised host and a clear-signing descriptor that iterates an attacker-controlled array of more than 255 elements, and does not require blind signing, a non-default setting or physical access. Ledger describes exploitation as difficult because few contracts accept arrays that large, and names a compromised multisig frontend as the main threat; where a threshold of signatures is required, the attacker still needs the full threshold over the same transaction hash. In Ledger’s single-owner proof of concept on a private fork, a 257-operation batch was signed after one operation was shown and the 256 undisplayed operations executed.

Ledger lists Ethereum app 1.19.0 through 1.22.2 as affected and states that 1.22.3, which rejects counts that do not fit the field, was published on 25 August 2026 for all its device targets. The same release also fixes several lower-severity review issues from Ledger’s internal review, and the separate swap flaw described in LSB-025.

Felipe A. Manzano of Bitfinding reported the flaw with a proof of concept through Ledger’s bug bounty programme on 28 March 2026, and a variant was reported separately by Florian Pradines. According to the bulletin, Ledger classified it as High on 23 April and merged a correction on 5 May, but Ethereum app 1.22.2, tagged on 13 August, shipped without it until the reporter flagged the omission on 23 August. CryptoSlate and Coin360 note that the bulletins do not explain why the merged fix was missing from 1.22.2. Ledger published the bulletin on 27 August 2026.

What Ledger advises:

• Install Ethereum app 1.22.3 or later and confirm the application version on the device.