CVE-2026-126049
4.6 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-416
Public exploit & PoC references
All references
- https://github.com/aqbanking/gwenhywfar/blob/f5c3f9dc56aa20cab85fd149885474239cf68632/src/parser/tlv.c#L651-L672
- https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738
- https://github.com/aqbanking/gwenhywfar/commit/dc8b80945e877f5bdf2d2ae1b50c928c15e990b0
- https://www.aquamaniac.de/rdm/projects/gwenhywfar/files
- https://www.vulncheck.com/advisories/gwenhywfar-5.14.2-use-after-free-via-gwen-tlv-buffer-to-db-nested-ber-tlv-parsing
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-55654PoC
- MEDIUMCVE-2025-60476PoC
- MEDIUMCVE-2025-60478PoC
- MEDIUMCVE-2025-60491PoC
- CRITICALCVE-2026-0163
- HIGHCVE-2026-100200
- CRITICALCVE-2026-100202
- HIGHCVE-2026-100204
Related by shared AI tags and CWE weakness class. Browse the full archive.