CVE-2025-15645: Ledger Flex

Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days.

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability.

Affected products

• Ledger Ledger Flex: before 1.2.2 (fixed in 1.2.2)
• Ledger Ledger Nano X: before 2.4.2 (fixed in 2.4.2)
• Ledger Ledger Stax: before 1.6.2 (fixed in 1.6.2)

Published 2026-05-19. Last modified 2026-07-24.