{"id":"CVE-2026-126048","kind":"vulnerability","aliases":["CVE-2026-126048"],"related":[],"title":"Gwenhywfar: stack overflow in TLV parser lets a malicious chip card crash apps","description":"Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application.","summary":"Gwenhywfar, a C library used by banking and smart-card software, has a stack-based buffer overflow when decoding BER-TLV tags into a fixed 128-byte buffer. An attacker who supplies a crafted record, such as a malicious chip card's EF_SSD file read through libchipcard's ZKA driver, can crash the application.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["banking-software","c","gwenhywfar","libchipcard","package"],"not_affected_if":["no-chip-card-reading","not-using-zka-driver"],"how_to_check":"- Check the installed Gwenhywfar version with `pkg-config --modversion gwenhywfar` or `gwenhywfar-config --version`; versions before `5.14.2` are in the vulnerable range\n- Look for libchipcard's ZKA driver in use on systems that read chip cards","fix":"- Gwenhywfar: move to `5.14.2` or later","status":"open","published_at":"2026-11-10T17:17:31+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","triaged_at":"2026-11-10T17:24:37+00:00","updated_at":"2026-11-10T17:24:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T17:24:37Z","model":"claude-haiku-5-5","output":{"fix":"- Gwenhywfar: move to `5.14.2` or later","reach":"local","title":"Gwenhywfar: stack overflow in TLV parser lets a malicious chip card crash apps","impact":"low","summary":"Gwenhywfar, a C library used by banking and smart-card software, has a stack-based buffer overflow when decoding BER-TLV tags into a fixed 128-byte buffer. An attacker who supplies a crafted record, such as a malicious chip card's EF_SSD file read through libchipcard's ZKA driver, can crash the application.","audience":"developers","category":"package","nicknames":[],"who_cares":["gwenhywfar","libchipcard","banking-software","c"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Application crashes when a malicious chip card is read","analyst_note":"","how_to_check":"- Check the installed Gwenhywfar version with `pkg-config --modversion gwenhywfar` or `gwenhywfar-config --version`; versions before `5.14.2` are in the vulnerable range\n- Look for libchipcard's ZKA driver in use on systems that read chip cards","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-chip-card-reading","not-using-zka-driver"],"who_is_affected":"Applications built on Gwenhywfar 4.99.8beta through 5.14.1 are exposed, most notably those that read chip cards through libchipcard's ZKA driver. The bug is triggered by card data, so systems that never read untrusted cards can likely skip it. unknown whether other parsing paths are reachable.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000778,"input_tokens":4692,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126048':16A,19A '-2026':15A,18A '127':124C '128':55B,114C '4.99.8':86C '5.14.2':89C 'app':13A 'applic':84B,157C 'attack':59B,117C 'bank':21B,33B 'banking-softwar':20B 'base':43B,94C 'ber':49B,108C 'ber-tlv':48B,107C 'beta':87C 'buffer':44B,57B,95C,100C,116C 'byte':56B,115C,129C,135C 'c':23B,29B 'card':11A,37B,70B,143C 'chip':10A,69B,142C 'contain':90C 'continu':128C 'craft':63B 'crash':12A,82B,155C 'cve':14A,17A 'db':102C 'decod':47B,106C 'driver':80B,153C 'ef':72B,145C 'file':74B,147C 'fix':54B,113C 'gwen':98C 'gwenhywfar':1A,24B,27B,85C 'let':7A 'libchipcard':25B,77B,150C 'librari':30B 'malici':9A,68B,141C 'multi':134C 'multi-byt':133C 'overflow':3A,45B,96C 'packag':26B 'parser':6A 'read':75B,148C 'record':64B,121C 'smart':36B 'smart-card':35B 'softwar':22B,38B 'src/parser/tlv.c':104C 'ssd':73B,146C 'stack':2A,42B,93C 'stack-bas':41B,92C 'suppli':61B,119C 'tag':51B,110C,127C,136C 'tlv':5A,50B,99C,109C 'truncat':132C 'use':31B 'via':139C 'zka':79B,152C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Gwenhywfar 4.99.8beta through 5.14.1 are exposed, most notably those that read chip cards through libchipcard's ZKA driver. The bug is triggered by card data, so systems that never read untrusted cards can likely skip it. unknown whether other parsing paths are reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bankingsoftware","c","gwenhywfar","libchipcard","medium","package"],"campaign_type":null,"search_a":"'-126048':16A,19A '-2026':15A,18A 'app':13A 'card':11A 'chip':10A 'crash':12A 'cve':14A,17A 'gwenhywfar':1A 'let':7A 'malici':9A 'overflow':3A 'parser':6A 'stack':2A 'tlv':5A","search_b":"'128':55B 'applic':84B 'attack':59B 'bank':21B,33B 'banking-softwar':20B 'base':43B 'ber':49B 'ber-tlv':48B 'buffer':44B,57B 'byte':56B 'c':23B,29B 'card':37B,70B 'chip':69B 'craft':63B 'crash':82B 'decod':47B 'driver':80B 'ef':72B 'file':74B 'fix':54B 'gwenhywfar':24B,27B 'libchipcard':25B,77B 'librari':30B 'malici':68B 'overflow':45B 'packag':26B 'read':75B 'record':64B 'smart':36B 'smart-card':35B 'softwar':22B,38B 'ssd':73B 'stack':42B 'stack-bas':41B 'suppli':61B 'tag':51B 'tlv':50B 'use':31B 'zka':79B","search_c":"'127':124C '128':114C '4.99.8':86C '5.14.2':89C 'applic':157C 'attack':117C 'base':94C 'ber':108C 'ber-tlv':107C 'beta':87C 'buffer':95C,100C,116C 'byte':115C,129C,135C 'card':143C 'chip':142C 'contain':90C 'continu':128C 'crash':155C 'db':102C 'decod':106C 'driver':153C 'ef':145C 'file':147C 'fix':113C 'gwen':98C 'gwenhywfar':85C 'libchipcard':150C 'malici':141C 'multi':134C 'multi-byt':133C 'overflow':96C 'read':148C 'record':121C 'src/parser/tlv.c':104C 'ssd':146C 'stack':93C 'stack-bas':92C 'suppli':119C 'tag':110C,127C,136C 'tlv':99C,109C 'truncat':132C 'via':139C 'zka':152C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126048","severity":null,"published_at":"2026-11-10T17:17:31+00:00","modified_at":"2026-11-10T17:17:31+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","fetched_at":"2026-11-10T17:22:41+00:00","note":null}],"documents":[{"id":116512,"url":"https://github.com/aqbanking/gwenhywfar/commit/6b50388e6b4a96f02d3d56e1d7747405fa881f39","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116513,"url":"https://github.com/aqbanking/gwenhywfar/commit/ed8e2f8cdc27fd5c1b629cf9c1f6b93b2e009757","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116514,"url":"https://www.vulncheck.com/advisories/gwenhywfar-4.99-8beta-before-5.14.2-stack-buffer-overflow-via-gwen-tlv-buffer-to-db","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}