Ledger Bitcoin app versions 2.1.0 and 2.1.1 allow an attacker to supply a malformed miniscript policy containing the a: fragment that causes the device to derive and present an incorrect receiving Bitcoin address. The vulnerability is a consequence of improper handling of miniscript policies and is classified as CWE-682. If an attacker can influence the policy, they may trick a user into sending funds to a wrong address, leading to potential loss of cryptocurrency.

The affected system is the Ledger Bitcoin app running on Ledger hardware wallets. Versions 2.1.0 and 2.1.1 of the app are impacted. No other versions, vendors, or platforms are listed as affected in the advisory.

The CVSS score of 4.1 indicates moderate severity, and the EPSS score is not available, so there is no publicly documented estimation of exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been reported as actively exploited. Attackers would need to persuade a user to load a crafted miniscript policy, a scenario that may occur if the user accepts a malicious transaction proposal. The lack of a remote code execution vector limits the impact to incorrect address generation, but the financial consequences can be significant if the user blindly trusts the displayed address.