1sealsemantic last-mile verification

Research / Finding

Ledger Bitcoin app: Merkle binding bypass

F-LEDGER-BTC-MERKLE-001

Read the full technical write-up →

Root cause, affected code and disclosure timeline.

At a glance

Conditions
A malicious host interacting with the signing flow can bypass a reported Merkle preimage integrity check.
What to do
Check for the recorded commit in the app build you use. No fixed app release is recorded here; a code fix is not proof that your device has received it.

1seal reading guide, reviewed 2026-09-25 against the linked records. Not a new vendor assessment or a device rollout check.

Fix and severity by source
  • 1SEAL-2026-005 (1seal assessment)Write-up dated: 2026-03-17

    Fix / version: commit 0586ab2
    Severity: high; numeric score not recorded; CVSS 3.1 vector recorded separately

Source assessments remain separate. Different CVSS versions are not a revision of one another. Code fixes, released versions and deployed updates are distinct evidence.

A reported merkle preimage binding failure bypasses a signing-path integrity gate. This is not a claim about every device or deployed version.

Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.

Read the evidence · View in research browse

Recorded evidence

—score not recorded
1SEAL-2026-0051SEAL advisoryLedgerHQ/app-bitcoin

signing-path integrity gate bypass via merkle preimage binding break

Fixed in: commit 0586ab2

Fix recordednot counted
details
Finding IDs
F-LEDGER-BTC-MERKLE-001
Status
patched
CWE
CWE-825
Fixed in
commit 0586ab2
Disclosure date
Recorded severity
high
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

F-LEDGER-BTC-MERKLE-001: Verification failures. Merkle preimage validation fails to bind the signing-path data. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-LEDGER-BTC-MERKLE-001

Security area (1seal assessment): Integrity. Merkle preimage validation fails to bind the signing-path data. Reviewed 24 Sep 2026.

Clarify or correct this record privately. The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy.

How this page groups evidence

This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.