CVE-2026-126049

Description

Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738 ↗
• https://github.com/aqbanking/gwenhywfar/commit/dc8b80945e877f5bdf2d2ae1b50c928c15e990b0 ↗
• https://www.aquamaniac.de/rdm/projects/gwenhywfar/files ↗
• https://github.com/aqbanking/gwenhywfar/blob/f5c3f9dc56aa20cab85fd149885474239cf68632/src/parser/tlv.c#L651-L672 ↗
• https://www.vulncheck.com/advisories/gwenhywfar-5.14.2-use-after-free-via-gwen-tlv-buffer-to-db-nested-ber-tlv-parsing ↗