{"id":"CVE-2026-126049","summary":"Gwenhywfar 5.14.2 Use-After-Free via GWEN_TLV_Buffer_To_DB() Nested BER-TLV Parsing","details":"Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory.","modified":"2026-11-14T07:04:12.863814684Z","published":"2026-11-10T16:58:04.296Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126049.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"5.14.2"},{"fixed":"5.14.3"}],"source":"AFFECTED_FIELD"}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-416"]},"references":[{"type":"WEB","url":"https://www.aquamaniac.de/rdm/projects/gwenhywfar/files"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126049.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126049"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gwenhywfar-5.14.2-use-after-free-via-gwen-tlv-buffer-to-db-nested-ber-tlv-parsing"},{"type":"FIX","url":"https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738"},{"type":"FIX","url":"https://github.com/aqbanking/gwenhywfar/commit/dc8b80945e877f5bdf2d2ae1b50c928c15e990b0"},{"type":"PACKAGE","url":"https://github.com/aqbanking/gwenhywfar"},{"type":"ARTICLE","url":"https://github.com/aqbanking/gwenhywfar/blob/f5c3f9dc56aa20cab85fd149885474239cf68632/src/parser/tlv.c#L651-L672"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aqbanking/gwenhywfar","events":[{"introduced":"0"},{"fixed":"828b34135dfa33fc347a2929caa2f079ffb00738"},{"fixed":"dc8b80945e877f5bdf2d2ae1b50c928c15e990b0"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"828b34135dfa33fc347a2929caa2f079ffb00738"}]},{"range":[{"fixed":"dc8b80945e877f5bdf2d2ae1b50c928c15e990b0"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["5.14.2","5.14.1","5.14","5.13.0","5.12.2","5.12.1","5.12.0","5.11.2beta","5.11.0beta","5.10.1","5.9.10","5.7.0beta","5.2.0","5.1.3","5.1.2","5.1.0","5.0.0","4.99.25rc9","4.99.23rc7","4.99.22rc6","4.99.21rc5","4.99.20rc4","4.99.19rc3","4.99.18rc2","4.99.17rc1","4.99.16beta","4.99.15beta","4.99.14beta","4.99.13beta","4.99.11beta","4.99.10beta","4.99.9beta","4.99.8beta","4.99.7beta","4.99.6beta","4.99.5beta","4.99.2beta","4.17.0","4.16.0beta","4.15.6beta","4.15.5beta","4.15.4beta","4.5.13","4.15.3","4.15.2beta","4.15.1beta","4.15.0","4.14.0","4.13.1","4.13.0","4.12.0beta","4.11.1beta","4.10.0beta","4.9.0beta","3.8.0beta","3.7.0beta","4.6.0beta","4.5.0beta","4.4.2beta","4.4.1beta","4.4.0beta","4.3.1","4.3.0","4.2.1","4.2.0","4.1.0","4.0.9","4.0.8","4.0.7","4.0.6","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","4.0.0stable","3.99.25rc","3.99.23rc6","3.99.22rc5","3.99.19rc2","3.99.18rc1","3.99.17beta","3.99.16beta","3.99.15beta","3.99.14beta","3.99.13beta","3.99.12beta","3.99.11beta","3.99.10beta","3.99.9beta","3.99.8beta","3.99.5beta","3.99.3beta","3.99.2beta","3.99.1beta","3.11.8beta","3.11.7beta","3.11.6beta","3.11.5beta","3.11.4beta","3.11.2","3.11.1","3.11.0","3.10.1","3.10.0","3.9.0","3.8.2","3.8.1","3.8.0","3.7.2","3.7.1","3.7.0","3.6.0","3.5.1","3.4.1","3.4.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738","target":{"file":"src/parser/tlv.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["335281712604939613105583457957185409397","42823223876147084458232459262823656804","287989837772403066606421038734227543987","95681505957865963394610351967840538000"]},"id":"CVE-2026-126049-4fb99d0e"},{"id":"CVE-2026-126049-e8a2f772","signature_type":"Function","signature_version":"v1","source":"https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738","target":{"file":"src/parser/tlv.c","function":"GWEN_TLV_Buffer_To_DB"},"deprecated":false,"digest":{"length":1810,"function_hash":"164470728705309571243483374959663218215"}}],"vanir_signatures_modified":"2026-11-14T07:04:12Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126049.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}