CVE-2026-126048 · Package
NO FIX YET · SEE WHAT TO DO
Gwenhywfar, a C library used by banking and smart-card software, has a stack-based buffer overflow when decoding BER-TLV tags into a fixed 128-byte buffer. An attacker who supplies a crafted record, such as a malicious chip card's EF_SSD file read through libchipcard's ZKA driver, can crash the application.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on Gwenhywfar 4.99.8beta through 5.14.1 are exposed, most notably those that read chip cards through libchipcard's ZKA driver. The bug is triggered by card data, so systems that never read untrusted cards can likely skip it. unknown whether other parsing paths are reachable.
Not affected if no-chip-card-reading, not-using-zka-driver
Who cares banking-software, c, gwenhywfar, libchipcard
pkg-config --modversion gwenhywfar or gwenhywfar-config --version; versions before 5.14.2 are in the vulnerable range5.14.2 or laterGwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.