CVE-2026-65058: CWE-358 Improperly Implemented Security Check for Standard in Trezor Safe 3
CVE-2026-65058 is a medium severity vulnerability in Trezor Safe 3, Safe 5, and Safe 7 firmware involving a confirmation-binding flaw in the Ethereum transaction signing process. The device only confirms the initial calldata chunk during contract interactions, while the signature commits to the entire streamed calldata. This discrepancy allows an attacker to present one calldata to the user but sign a different transaction by supplying a modified tail. The issue has been fixed in commit 70c9b0c.
AI Analysis
Technical Summary
This vulnerability (CWE-358) affects Trezor Safe 3, Safe 5, and Safe 7 firmware in the Ethereum sign_tx / sign_tx_eip1559 flow. The flaw lies in the device confirming only the initial part of the calldata while the signature covers the full calldata stream, enabling an attacker to alter the transaction after user confirmation. The vulnerability was addressed in commit 70c9b0c.
Potential Impact
An attacker could trick a user into confirming a transaction with one calldata but have the device sign a different transaction with a modified calldata tail. This leads to a high integrity impact, as the signed transaction may not match the user's intent. Confidentiality and availability are not affected. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available as indicated by the reference to commit 70c9b0c. Users should update their Trezor Safe 3, Safe 5, and Safe 7 firmware to the fixed version containing this commit. Patch status is not explicitly confirmed in the advisory, so users should verify the update includes this fix.
CVE-2026-65058: CWE-358 Improperly Implemented Security Check for Standard in Trezor Safe 3
Description
CVE-2026-65058 is a medium severity vulnerability in Trezor Safe 3, Safe 5, and Safe 7 firmware involving a confirmation-binding flaw in the Ethereum transaction signing process. The device only confirms the initial calldata chunk during contract interactions, while the signature commits to the entire streamed calldata. This discrepancy allows an attacker to present one calldata to the user but sign a different transaction by supplying a modified tail. The issue has been fixed in commit 70c9b0c.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-358) affects Trezor Safe 3, Safe 5, and Safe 7 firmware in the Ethereum sign_tx / sign_tx_eip1559 flow. The flaw lies in the device confirming only the initial part of the calldata while the signature covers the full calldata stream, enabling an attacker to alter the transaction after user confirmation. The vulnerability was addressed in commit 70c9b0c.
Potential Impact
An attacker could trick a user into confirming a transaction with one calldata but have the device sign a different transaction with a modified calldata tail. This leads to a high integrity impact, as the signed transaction may not match the user's intent. Confidentiality and availability are not affected. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available as indicated by the reference to commit 70c9b0c. Users should update their Trezor Safe 3, Safe 5, and Safe 7 firmware to the fixed version containing this commit. Patch status is not explicitly confirmed in the advisory, so users should verify the update includes this fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisa-cg
- Date Reserved
- 2026-07-21T14:35:48.323Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5fdc259c2644c7f8ba051e
Added to database: 07/21/2026, 20:52:53 UTC
Last enriched: 07/21/2026, 21:08:31 UTC
Last updated: 07/21/2026, 21:08:31 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.