Back to security portal
Trezor T Bootloader firmware update retry could skip header checks
Reported on September 29, 2026
During a firmware update, the bootloader could be made to install a different firmware from the one it had checked. This only affected unreleased code and was fixed before release.
Reported by Adesh Kolte
Reward 1000 USD
Resolved vulnerabilities
Reported by community. Investigated. Resolved. Because your security is never optional.
- E-shop referral discount could be applied to eGift card purchasesSeptember 16, 2026
- Authenticity proofs not bounded to their secure element on TS7August 16, 2026
- Monero payment ID could be signed without being shownAugust 13, 2026
- Missing bounds check in JPEG image decodingAugust 12, 2026
- Stellar signer weight not shown when adding a signerAugust 8, 2026
- E-shop eGift card amount could be set outside the allowed valuesAugust 7, 2026