---
id: "CVE-2026-126049"
page: "https://infrastack.ai/live/CVE-2026-126049"
kind: "vulnerability"
aliases: ["CVE-2026-126049"]
title: "Gwenhywfar: heap use-after-free in TLV parser lets crafted data corrupt memory"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "gwenhywfar", "libchipcard", "package"]
not_affected_if: ["no-tlv-parsing"]
published_at: "2026-11-10T17:17:31+00:00"
first_seen_at: "2026-11-10T17:22:41+00:00"
updated_at: "2026-11-10T17:24:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126049", "first_seen_at": "2026-11-10T17:22:41+00:00"}]
exploit_sources: []
---

# Gwenhywfar: heap use-after-free in TLV parser lets crafted data corrupt memory

Link for people: https://infrastack.ai/live/CVE-2026-126049 (this .md is for agents)

Gwenhywfar 5.14.2 frees a nested GWEN_DB node when a BER-TLV record fails to parse, then keeps using it, causing a heap use-after-free in GWEN_TLV_Buffer_To_DB(). An attacker who supplies a constructed TLV record, for example through a malicious chip card read by libchipcard, can corrupt heap memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T17:22:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126049

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/gwenhywfar-5.14.2-use-after-free-via-gwen-tlv-buffer-to-db-nested-ber-tlv-parsing
- [fix] Patch: github.com https://github.com/aqbanking/gwenhywfar/commit/828b34135dfa33fc347a2929caa2f079ffb00738
- [fix] Patch: github.com https://github.com/aqbanking/gwenhywfar/commit/dc8b80945e877f5bdf2d2ae1b50c928c15e990b0

## From the sources

Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_