Ledger Secure SDK flaw let a host change transaction details after on-screen review

Ledger’s security bulletin LSB-023 describes a flaw in the input/output handling of the Ledger Secure SDK, the library on which device applications are built. According to Ledger, a host could send a new command to the device while a previous one was still awaiting its reply during an on-screen review, so the signing parameters could change after the user had seen them but before the device signed. Ledger classifies it as a time-of-check to time-of-use issue (CWE-362) and states that the device operating system and firmware are not affected.

Ledger states that exploitation requires an adversary in control of the command exchange with the device, such as a malicious or compromised wallet application, a hostile web page holding a WebHID or WebUSB connection, or malware on the connected computer. According to the bulletin, the user could approve an operation the device described accurately and receive a signature over different parameters, with no indication of the substitution on the device. Ledger lists as affected applications built against SDK releases from August 2025 through v26.6.0 that do not validate application state on every asynchronous entry point.

Ledger states that Ethereum app 1.22.2, published on 13 August 2026, was the first release with application-level guards, and that SDK v26.6.1, released on 21 August 2026, refuses incoming commands while a reply is pending; its own applications were rebuilt against it and republished the same day. The bulletin credits Ledger’s internal security review. After the fix, OneKey’s security team reproduced the attack in a lab against Ethereum app 1.22.1, which its CEO Yishi Wang presented on X as a transaction replacement attack; Ledger CTO Charles Guillemet rejected describing this as hacking Ledger, saying the flaw had already been fixed in 1.22.2, according to Decrypt.

The regression dates from August 2025, according to Ledger, which published the bulletin on 27 August 2026.

What Ledger advises:

• Update applications through Ledger Live and check the application version on the device; a firmware update alone does not replace affected applications.
• Third-party developers should audit their command handlers and rebuild against Ledger Secure SDK v26.6.1 or later.