CVE-2026-126048— Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()
Quick assessment
Affected
Martin Preuss Gwenhywfar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gwenhywfar 4.99.8beta 至 5.14.2 之前的版本存在一个基于栈的缓冲区溢出漏洞。该漏洞位于 文件中的 函数，发生在将 BER-TLV 标签解码至一个固定长度为 128 字节的缓冲区时。攻击者可以构造包含约 127 个或更多标签续传字节（tag continuation bytes）的记录，或提供被截断的多字节标签（例如通过 libchipcard 的 ZKA 驱动程序读取恶意芯片卡的 EF_SSD 文件），从而触发应用程序崩溃。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-126048
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()
Source: CVE Program / CVE List V5
Vulnerability Description
Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte tag, such as via a malicious chip card's EF_SSD file read by libchipcard's ZKA driver, to crash the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Martin Preuss | Gwenhywfar | 4.99.8beta ~ 5.14.2 | - |
|
II. Public POCs for CVE-2026-126048
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-126048
请登录查看更多情报信息。