CVE-2026-126048 Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()

Medium 5.1 Published 10 Nov 2026 Updated 10 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-126048?

CVE-2026-126048 is a medium-severity vulnerability in Martin Preuss Gwenhywfar, published on 10 Nov 2026.

Official description

Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application.

Weakness: CWE-121

Which versions are affected by CVE-2026-126048?

How do I fix CVE-2026-126048?

No fix has been published for CVE-2026-126048 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-126048 being exploited?

There is no known exploitation of CVE-2026-126048 in the wild and no public exploit code.

Sources

Also known as GHSA-p2q4-gvgq-p985.