Exploit for CVE-2026-65058

## https://sploitus.com/exploit?id=D9E9835C-8DFC-5780-8EE6-79A842138E12
# Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65058

**Proof of Concept & Security Research**

[![CVE](https://img.shields.io/badge/CVE-2026--65058-red)](https://nvd.nist.gov/vuln/detail/CVE-2026-65058)
[![CVSS](https://img.shields.io/badge/CVSS-7.4-orange)](https://nvd.nist.gov/vuln/detail/CVE-2026-65058)
[![Python](https://img.shields.io/badge/python-3.8%2B-blue)](https://python.org)
[![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)

A critical vulnerability in Trezor Safe 3/5/7 firmware (= 2.8.7 (the ONLY complete fix)
2. **Review**: Check existing token approvals at [revoke.cash](https://revoke.cash)
3. **Verify**: Run `python poc/verify_fix.py --self-test` to confirm fix behavior

See [`docs/MITIGATION.md`](docs/MITIGATION.md) for full guidance.

## Timeline

- **2026-07-15** — Vulnerability discovered
- **2026-07-18** — Responsible disclosure to SatoshiLabs
- **2026-07-22** — SatoshiLabs confirms and begins fix
- **2026-07-25** — CVE-2026-65058 assigned
- **2026-07-31** — Firmware 2.8.7 released
- **2026-08-05** — Public disclosure & PoC release

## Ethical Statement

This repository is published for:
- **Security research** — understanding hardware wallet vulnerabilities
- **Education** — teaching secure transaction confirmation design
- **Verification** — enabling users to verify their devices are patched

This code should ONLY be used on devices you own, in controlled environments,
and in accordance with applicable laws and Trezor's responsible disclosure
guidelines.

## License

MIT License — See LICENSE file for details.

## Contact

- GitHub Issues: [Report a bug](https://github.com/helper-beeps/trezor-cve-2026-65058/issues)
- Security: Responsible disclosure via GitHub Security Advisories