CVE-2026-126049

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-126049

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126049.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-126049

Published

2026-11-10T16:58:04Z

Modified

2026-11-14T07:04:12Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Gwenhywfar 5.14.2 Use-After-Free via GWEN_TLV_Buffer_To_DB() Nested BER-TLV Parsing

Details

Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126049.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "5.14.2"
                        },
                        {
                            "fixed": "5.14.3"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/aqbanking/gwenhywfar

Affected ranges

Type

GIT

Repo

https://github.com/aqbanking/gwenhywfar

Events

Introduced

Fixed

828b34135dfa33fc347a2929caa2f079ffb00738

Fixed

dc8b80945e877f5bdf2d2ae1b50c928c15e990b0

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "828b34135dfa33fc347a2929caa2f079ffb00738"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "dc8b80945e877f5bdf2d2ae1b50c928c15e990b0"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*

3.10.0

3.10.1

3.11.0

3.11.1

3.11.2

3.11.4beta

3.11.5beta

3.11.6beta

3.11.7beta

3.11.8beta

3.4.0

3.4.1

3.5.1

3.6.0

3.7.0

3.7.0beta

3.7.1

3.7.2

3.8.0

3.8.0beta

3.8.1

3.8.2

3.9.0

3.99.10beta

3.99.11beta

3.99.12beta

3.99.13beta

3.99.14beta

3.99.15beta

3.99.16beta

3.99.17beta

3.99.18rc1

3.99.19rc2

3.99.1beta

3.99.22rc5

3.99.23rc6

3.99.25rc

3.99.2beta

3.99.3beta

3.99.5beta

3.99.8beta

3.99.9beta

4.*

4.0.0stable

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.1.0

4.10.0beta

4.11.1beta

4.12.0beta

4.13.0

4.13.1

4.14.0

4.15.0

4.15.1beta

4.15.2beta

4.15.3

4.15.4beta

4.15.5beta

4.15.6beta

4.16.0beta

4.17.0

4.2.0

4.2.1

4.3.0

4.3.1

4.4.0beta

4.4.1beta

4.4.2beta

4.5.0beta

4.5.13

4.6.0beta

4.9.0beta

4.99.10beta

4.99.11beta

4.99.13beta

4.99.14beta

4.99.15beta

4.99.16beta

4.99.17rc1

4.99.18rc2

4.99.19rc3

4.99.20rc4

4.99.21rc5

4.99.22rc6

4.99.23rc7

4.99.25rc9

4.99.2beta

4.99.5beta

4.99.6beta

4.99.7beta

4.99.8beta

4.99.9beta

5.*

5.0.0

5.1.0

5.1.2

5.1.3

5.10.1

5.11.0beta

5.11.2beta

5.12.0

5.12.1

5.12.2

5.13.0

5.14

5.14.1

5.14.2

5.2.0

5.7.0beta

5.9.10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126049.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "335281712604939613105583457957185409397",
                "42823223876147084458232459262823656804",
                "287989837772403066606421038734227543987",
                "95681505957865963394610351967840538000"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126049-4fb99d0e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738",
        "target": {
            "file": "src/parser/tlv.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "164470728705309571243483374959663218215",
            "length": 1810
        },
        "id": "CVE-2026-126049-e8a2f772",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738",
        "target": {
            "file": "src/parser/tlv.c",
            "function": "GWEN_TLV_Buffer_To_DB"
        }
    }
]

vanir_signatures_modified

"2026-11-14T07:04:12Z"