aqbanking vulnerabilities

Products

• aqbanking/gwenhywfar 2

Latest aqbanking CVEs

Newest publication first

1. CVE-2026-126049 Gwenhywfar 5.14.2 Use-After-Free via GWEN_TLV_Buffer_To_DB() Nested BER-TLV Parsing

   Published 2026-11-10

   Medium·CVSS 5.1 EPSS 0.19%

   Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which frees a nested record's GWEN_DB node when parsing of its contents fails but continues processing and adds the freed node to the parent instead of returning. Attack...

2. CVE-2026-126048 Gwenhywfar 4.99.8beta before 5.14.2 Stack Buffer Overflow via GWEN_TLV_Buffer_To_DB()

   Published 2026-11-10

   Medium·CVSS 5.1 EPSS 0.22%

   Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c when decoding BER-TLV tags into a fixed 128-byte buffer. Attackers can supply a record with about 127 or more tag continuation bytes or a truncated multi-byte...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.