CVE-2026-126049 Gwenhywfar 5.14.2 Use-After-Free via GWEN_TLV_Buffer_To_DB() Nested BER-TLV Parsing

Medium 5.1 Published 10 Nov 2026 Updated 10 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-126049?

CVE-2026-126049 is a medium-severity vulnerability in Martin Preuss Gwenhywfar, published on 10 Nov 2026.

Official description

Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attackers can supply a constructed BER-TLV record with unparseable contents, such as via a malicious chip card read by libchipcard, to corrupt heap memory.

Weakness: CWE-416

Which versions are affected by CVE-2026-126049?

How do I fix CVE-2026-126049?

No fix has been published for CVE-2026-126049 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-126049 being exploited?

There is no known exploitation of CVE-2026-126049 in the wild and no public exploit code.

Sources

Also known as GHSA-q838-74px-f7cc.