{"id":"CVE-2026-126048","summary":"Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()","details":"Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application.","modified":"2026-11-14T07:04:13.243832310Z","published":"2026-11-10T16:58:03.611Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-121"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126048.json"},"references":[{"type":"WEB","url":"https://www.aquamaniac.de/rdm/projects/gwenhywfar/files"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126048.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126048"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gwenhywfar-4.99-8beta-before-5.14.2-stack-buffer-overflow-via-gwen-tlv-buffer-to-db"},{"type":"FIX","url":"https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39"},{"type":"FIX","url":"https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757"},{"type":"PACKAGE","url":"https://github.com/aqbanking/gwenhywfar"},{"type":"ARTICLE","url":"https://github.com/aqbanking/gwenhywfar/blob/424949d0c6e61028eaccd6e46e4c0c41931c2b2f/src/parser/tlv.c#L629-L655"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aqbanking/gwenhywfar","events":[{"introduced":"bff6feeb2f02e357d5df45b4e9bfd4a7eed867ee"},{"fixed":"f5c3f9dc56aa20cab85fd149885474239cf68632"},{"fixed":"ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757"},{"fixed":"6b50388e6b4a96f02d3d56e1d7747405fa881f39"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"4.99.8beta"},{"fixed":"5.14.2"}]},{"range":[{"fixed":"ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"6b50388e6b4a96f02d3d56e1d7747405fa881f39"}]}]}}],"versions":["5.14.1","5.14","5.13.0","5.12.2","5.12.1","5.12.0","5.11.2beta","5.11.0beta","5.10.1","5.9.10","5.7.0beta","5.2.0","5.1.3","5.1.2","5.1.0","5.0.0","4.99.25rc9","4.99.23rc7","4.99.22rc6","4.99.21rc5","4.99.20rc4","4.99.19rc3","4.99.18rc2","4.99.17rc1","4.99.16beta","4.99.15beta","4.99.14beta","4.99.13beta","4.99.11beta","4.99.10beta","4.99.9beta","4.99.8beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126048.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"309411532732068341354311457557778649717","length":1320},"id":"CVE-2026-126048-2bf2b14e","signature_type":"Function","signature_version":"v1","source":"https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757","target":{"file":"src/parser/tlv.c","function":"GWEN_TLV_Buffer_To_DB"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757","target":{"file":"src/parser/tlv.c"},"deprecated":false,"digest":{"line_hashes":["335664506072729683273480463240007442599","40582230293354854814832321288723494637","281953859708972318137139484631964564006","54453650933722254560430855233420301525","239451399737739324708425538956455390062","319771471860620858910742406806187423911","221588554401689069756328967748919626971","83153428570975565098399887865620315664","139820458686311852588653578813075217829","123324979879511727339117899939864064351","174071153001481997145229995143612816310","321730686087654100692348124390953780129","99970815642697907825652524181452875221","241741624916004566080533737133342006564","18720391318826420068372351489393538395","269116235371475870847434092182990099259","314731701191273995330592058138151991933","155354012114601336985352086871113250145","295348709732824757865121177044696076040","331181678583584028391686018352554486068","296401067232906878671628775801704069949","198079732409001339697782618771932402683","13676799616236995328999767860376877948","224576464638983714634793103002759987420","213132638462026287384289636534537339173","260651696485933030124206099834090163919","42047110346231560397903657741152045523","164676568471840821292429048809826903334","293952402696668881664129510809912174724","6124039291959800551101400697269147987","170390206251774239256570756653242124763","212788784740672099352539346221978218075","232329502741455354611479894424330459885","253147527392376140334057531875169661732","250624057626381471843471057665684569989","83581080585459943241486599489466171573","309463305099301829995455793650616276537","221459481956229167780919811151374345261","65434862004729417180216015344193451037","80875962346259635864869243369841883814","9003940719324726910231236084853800937","47921910158441054611370039364994255282","190632885965595480759375158140545417332","258589948629504785371573433179651287677","207545714606362184916207340242432464687","99412960203221069343634949935094807692","334329453618280107519506223206156941763","284932827062687433344244501380547129818","110683278831877528888243965929129009834","62229661418638026924461591654649154784","56083423245330147818937563489344061781","124871545035969479018615137306092959661","285479849367994901221345592023977771795","63024508962677828235861025831621609501","222000935007123447518052830754364430260","68411857528770916665914373916896890682","1251348372888163122785215965520821520","229153555471747477437124239051480728203","273044645211350846033584871890401335473","163365333947463192760216260292028193514","75407180318704451699303769443305508093","81406090409011838573014318457896087828","95790529314361008110587193194398813218","104141159630066087313284298857947672359","263094772768637096089542941646317625821","316439960002847025884013137710992878986","324495310991409032518226127144956112618","295478717664907318947390455945878037075","132493687992004213900588808801507638884","74325926408019664288091163861679795442","65547936284977183903490760078203412131","53084594082829827218575232694212223810","61858457902503812454311245843502444383","299430983085918460189393562730855932032","245207548335935168502114291564101032327","134992108211767681128119378023060159274","302237802936332258141666044504060268668","186228752678082865279178462955256504082","165445107966917697336028305911120922486","227024517677804533713210889479303168272","338702942465514576727677660950821706278","48213225789133376819373710536192061461","50131829844319219069627800161817077093","128706036902914349689837759943129005589","126595295271991564129845521861065906509","4262585474519688447854451254561796378","86054807299258486999340097606600104881","338014136394885739526037500723010002541","30846048871521576423534799341624506109","45703971668975590024557666863596065696","54785282576542140426358428407959239093","62709220866238113751103390367142876651","173937824341388922043322013593469102343","252863845037236225851437504708674913432","275399121360355210702484479473303667994","74821582007291640328150702664248350082","77191098426949416052729081209446737544","316237787335084658190950858168922021272","84449033034449914770538272416257132452","224285027253387413868442132267848088086","210733015787790523852505290017335244292","15651381287605827126084240007509668776","148441672217230144054721716087739612171","323865113586447892795069393854531187210","52730902853519007211372714919471471628","288998964463684942667100110553476455395","23833296800274351194739412576685391217"],"threshold":0.9},"id":"CVE-2026-126048-2ceb6550"},{"deprecated":false,"digest":{"length":1363,"function_hash":"323812386337702029003368755108713478178"},"id":"CVE-2026-126048-955f0ec2","signature_type":"Function","signature_version":"v1","source":"https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39","target":{"file":"src/parser/tlv.c","function":"GWEN_TLV_Buffer_To_DB"}},{"id":"CVE-2026-126048-ad730185","signature_type":"Line","signature_version":"v1","source":"https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39","target":{"file":"src/parser/tlv.c"},"deprecated":false,"digest":{"line_hashes":["182450020491767493335697089799564433776","166965326090154330792821525015305303367","325317704493177552247044929194325873061","306419942033328711378141057103011360988","8533780330523565762455090387699932086","54049524106500199888169870965476598287","222129254676273182957096213781820587947","250391077715994945410257710269030551687","3671694360709270308276732100198701842","243453612599852460119033981493645373159","302237802936332258141666044504060268668","166992855666047713035556858562914611546","122491341498985814316364261545812323934","18893657753693446310586470101766598092","308033105741848924502829835954173858320","160162087721075068805570324448043183106","236264191081201346766968732305022625606","211267414482506090895901054395183982640","224285027253387413868442132267848088086","210733015787790523852505290017335244292","63299141034480232475204066204113269710","243158356264805019623949846454721351923","275345712024568791528033787532089777714","271492486457775986228747758717427426897","253009278906411794713207941863887284902","228722096217786333364209880635495221777","11834459372632180702625066335378739110","163396518514961249720547336809385955456","171669014472101654686698747158365233621"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"128961220638601679243104791801074120397","length":864},"id":"CVE-2026-126048-f135003c","signature_type":"Function","signature_version":"v1","source":"https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757","target":{"file":"src/parser/tlv.c","function":"hex2char"}}],"vanir_signatures_modified":"2026-11-14T07:04:13Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}