CVE-2026-126048

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126048
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126048.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126048
Published
2026-11-10T16:58:03Z
Modified
2026-11-14T07:04:13Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()
Details

Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-121"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126048.json"
}
References

Affected packages

Git / github.com/aqbanking/gwenhywfar

Affected ranges

Type
GIT
Repo
https://github.com/aqbanking/gwenhywfar
Events
Introduced
bff6feeb2f02e357d5df45b4e9bfd4a7eed867ee
Fixed
f5c3f9dc56aa20cab85fd149885474239cf68632
Fixed
ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757
Fixed
6b50388e6b4a96f02d3d56e1d7747405fa881f39
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "4.99.8beta"
                },
                {
                    "fixed": "5.14.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "6b50388e6b4a96f02d3d56e1d7747405fa881f39"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

4.*
4.99.10beta
4.99.11beta
4.99.13beta
4.99.14beta
4.99.15beta
4.99.16beta
4.99.17rc1
4.99.18rc2
4.99.19rc3
4.99.20rc4
4.99.21rc5
4.99.22rc6
4.99.23rc7
4.99.25rc9
4.99.8beta
4.99.9beta
5.*
5.0.0
5.1.0
5.1.2
5.1.3
5.10.1
5.11.0beta
5.11.2beta
5.12.0
5.12.1
5.12.2
5.13.0
5.14
5.14.1
5.2.0
5.7.0beta
5.9.10

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126048.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "309411532732068341354311457557778649717",
            "length": 1320
        },
        "id": "CVE-2026-126048-2bf2b14e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757",
        "target": {
            "file": "src/parser/tlv.c",
            "function": "GWEN_TLV_Buffer_To_DB"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "335664506072729683273480463240007442599",
                "40582230293354854814832321288723494637",
                "281953859708972318137139484631964564006",
                "54453650933722254560430855233420301525",
                "239451399737739324708425538956455390062",
                "319771471860620858910742406806187423911",
                "221588554401689069756328967748919626971",
                "83153428570975565098399887865620315664",
                "139820458686311852588653578813075217829",
                "123324979879511727339117899939864064351",
                "174071153001481997145229995143612816310",
                "321730686087654100692348124390953780129",
                "99970815642697907825652524181452875221",
                "241741624916004566080533737133342006564",
                "18720391318826420068372351489393538395",
                "269116235371475870847434092182990099259",
                "314731701191273995330592058138151991933",
                "155354012114601336985352086871113250145",
                "295348709732824757865121177044696076040",
                "331181678583584028391686018352554486068",
                "296401067232906878671628775801704069949",
                "198079732409001339697782618771932402683",
                "13676799616236995328999767860376877948",
                "224576464638983714634793103002759987420",
                "213132638462026287384289636534537339173",
                "260651696485933030124206099834090163919",
                "42047110346231560397903657741152045523",
                "164676568471840821292429048809826903334",
                "293952402696668881664129510809912174724",
                "6124039291959800551101400697269147987",
                "170390206251774239256570756653242124763",
                "212788784740672099352539346221978218075",
                "232329502741455354611479894424330459885",
                "253147527392376140334057531875169661732",
                "250624057626381471843471057665684569989",
                "83581080585459943241486599489466171573",
                "309463305099301829995455793650616276537",
                "221459481956229167780919811151374345261",
                "65434862004729417180216015344193451037",
                "80875962346259635864869243369841883814",
                "9003940719324726910231236084853800937",
                "47921910158441054611370039364994255282",
                "190632885965595480759375158140545417332",
                "258589948629504785371573433179651287677",
                "207545714606362184916207340242432464687",
                "99412960203221069343634949935094807692",
                "334329453618280107519506223206156941763",
                "284932827062687433344244501380547129818",
                "110683278831877528888243965929129009834",
                "62229661418638026924461591654649154784",
                "56083423245330147818937563489344061781",
                "124871545035969479018615137306092959661",
                "285479849367994901221345592023977771795",
                "63024508962677828235861025831621609501",
                "222000935007123447518052830754364430260",
                "68411857528770916665914373916896890682",
                "1251348372888163122785215965520821520",
                "229153555471747477437124239051480728203",
                "273044645211350846033584871890401335473",
                "163365333947463192760216260292028193514",
                "75407180318704451699303769443305508093",
                "81406090409011838573014318457896087828",
                "95790529314361008110587193194398813218",
                "104141159630066087313284298857947672359",
                "263094772768637096089542941646317625821",
                "316439960002847025884013137710992878986",
                "324495310991409032518226127144956112618",
                "295478717664907318947390455945878037075",
                "132493687992004213900588808801507638884",
                "74325926408019664288091163861679795442",
                "65547936284977183903490760078203412131",
                "53084594082829827218575232694212223810",
                "61858457902503812454311245843502444383",
                "299430983085918460189393562730855932032",
                "245207548335935168502114291564101032327",
                "134992108211767681128119378023060159274",
                "302237802936332258141666044504060268668",
                "186228752678082865279178462955256504082",
                "165445107966917697336028305911120922486",
                "227024517677804533713210889479303168272",
                "338702942465514576727677660950821706278",
                "48213225789133376819373710536192061461",
                "50131829844319219069627800161817077093",
                "128706036902914349689837759943129005589",
                "126595295271991564129845521861065906509",
                "4262585474519688447854451254561796378",
                "86054807299258486999340097606600104881",
                "338014136394885739526037500723010002541",
                "30846048871521576423534799341624506109",
                "45703971668975590024557666863596065696",
                "54785282576542140426358428407959239093",
                "62709220866238113751103390367142876651",
                "173937824341388922043322013593469102343",
                "252863845037236225851437504708674913432",
                "275399121360355210702484479473303667994",
                "74821582007291640328150702664248350082",
                "77191098426949416052729081209446737544",
                "316237787335084658190950858168922021272",
                "84449033034449914770538272416257132452",
                "224285027253387413868442132267848088086",
                "210733015787790523852505290017335244292",
                "15651381287605827126084240007509668776",
                "148441672217230144054721716087739612171",
                "323865113586447892795069393854531187210",
                "52730902853519007211372714919471471628",
                "288998964463684942667100110553476455395",
                "23833296800274351194739412576685391217"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126048-2ceb6550",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757",
        "target": {
            "file": "src/parser/tlv.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "323812386337702029003368755108713478178",
            "length": 1363
        },
        "id": "CVE-2026-126048-955f0ec2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39",
        "target": {
            "file": "src/parser/tlv.c",
            "function": "GWEN_TLV_Buffer_To_DB"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "182450020491767493335697089799564433776",
                "166965326090154330792821525015305303367",
                "325317704493177552247044929194325873061",
                "306419942033328711378141057103011360988",
                "8533780330523565762455090387699932086",
                "54049524106500199888169870965476598287",
                "222129254676273182957096213781820587947",
                "250391077715994945410257710269030551687",
                "3671694360709270308276732100198701842",
                "243453612599852460119033981493645373159",
                "302237802936332258141666044504060268668",
                "166992855666047713035556858562914611546",
                "122491341498985814316364261545812323934",
                "18893657753693446310586470101766598092",
                "308033105741848924502829835954173858320",
                "160162087721075068805570324448043183106",
                "236264191081201346766968732305022625606",
                "211267414482506090895901054395183982640",
                "224285027253387413868442132267848088086",
                "210733015787790523852505290017335244292",
                "63299141034480232475204066204113269710",
                "243158356264805019623949846454721351923",
                "275345712024568791528033787532089777714",
                "271492486457775986228747758717427426897",
                "253009278906411794713207941863887284902",
                "228722096217786333364209880635495221777",
                "11834459372632180702625066335378739110",
                "163396518514961249720547336809385955456",
                "171669014472101654686698747158365233621"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126048-ad730185",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39",
        "target": {
            "file": "src/parser/tlv.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "128961220638601679243104791801074120397",
            "length": 864
        },
        "id": "CVE-2026-126048-f135003c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757",
        "target": {
            "file": "src/parser/tlv.c",
            "function": "hex2char"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:04:13Z"