CVE-2026-65058 describes a vulnerability in Trezor Safe 3, Safe 5, and Safe 7 firmware related to Ethereum transaction signing (sign_tx / sign_tx_eip1559). The device confirms only the initial calldata chunk during contract interactions, but the signature commits to the full streamed calldata. This improper security check (CWE-358) allows an attacker to present one calldata to the user for confirmation but sign a different transaction by supplying a modified calldata tail. The flaw has been fixed in commit 70c9b0c. No explicit patch or remediation level is provided in the advisory.

An attacker could trick a user into confirming a transaction with certain calldata, but the device would sign a transaction with altered calldata, potentially changing the transaction's intent or destination. This could lead to unauthorized or malicious transactions being signed without the user's informed consent. The vulnerability does not affect confidentiality or availability but impacts transaction integrity.

The vulnerability has been fixed in commit 70c9b0c. However, no official patch or remediation level is explicitly stated in the provided data. Users should update their Trezor Safe firmware to the version including this fix once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.