CVE-2021-31616: Shapeshift Keepkey Firmware

High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days.

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB.

Affected products

• Shapeshift Keepkey Firmware: from 7.0.3, before 7.1.0 (fixed in 7.1.0)

Published 2021-05-06. Last modified 2026-06-17.