CVE-2026-58471
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c. The flaw occurs during character set conversion of a server-supplied filename when the reallocation logic miscalculates remaining space, leading to memory corruption.
Risk Assessment
An attacker can remotely exploit this vulnerability by sending a maliciously crafted server response, potentially leading to system compromise or application crash.
Recommendation
Immediately update GNU Wget to a version containing the fix (commit c2640fe) or later to eliminate the heap buffer overflow risk.
Other vulnerabilities in GNU Wget
See all- CVE-2016-4971High
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
- CVE-2014-4877High
CVE-2014-4877 in GNU Wget before version 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, leading to arbitrary code execution. This issue occurs in a LIST response that references the same filename in two entries, one of which indicates that the filename is for a symlink.
- CVE-2024-38428Medium
Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.
- CVE-2026-16599Medium
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
- CVE-2026-15146Medium
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server or an HTTP server redirecting to an FTP URL can exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port.
- CVE-2026-58472Medium
GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c. A remote attacker can exploit a crafted HTML attribute with a large number of characters requiring entity encoding, causing a signed integer overflow, undersized heap allocation, and subsequent heap buffer overflow.
- CVE-2026-58470Medium
In GNU Wget through version 1.25.0, an integer overflow vulnerability exists in the parse_content_range() function within src/http.c. Attackers can supply malicious Content-Range header values, causing signed integer arithmetic overflow, leading to undefined behavior and download desynchronization.
- CVE-2026-58469High
GNU Wget through version 1.25.0 contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document with a whitespace-only URL, causing a pointer to decrement past the buffer start.
Original NVD description (English source)
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.