CVE-2026-58471: GNU Wget Buffer Overflow Vulnerability

CVE-2026-58471 Overview

CVE-2026-58471 is a heap buffer overflow vulnerability in GNU Wget through version 1.25.0. The flaw resides in the convert_fname() function within src/url.c and is triggered during character set conversion of server-supplied filenames. When the output buffer proves too small during an iconvE2BIG reallocation, the reallocation logic miscalculates the remaining space. A remote attacker who controls or influences a server response can supply a crafted filename to corrupt the heap on the client host running Wget. The issue is classified under CWE-122 (Heap-based Buffer Overflow) and is fixed in upstream commit c2640fe.

Critical Impact
A malicious or compromised server can corrupt heap memory in a client running GNU Wget, enabling denial of service and potentially influencing process control flow when a user retrieves a resource requiring filename character set conversion.

Affected Products

GNU Wget versions up to and including 1.25.0
Linux and Unix distributions shipping the vulnerable Wget package
Automation, CI/CD, and scripting environments that invoke Wget against untrusted or attacker-influenced hosts

Discovery Timeline

2026-07-07 - CVE-2026-58471 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-58471

Vulnerability Analysis

The vulnerability lives in convert_fname() in src/url.c, which converts a server-supplied filename between character sets using the standard iconv interface. When iconv cannot fit converted bytes into the destination buffer, it returns E2BIG, signaling that the caller must grow the output buffer and retry. Wget's retry loop reallocates the buffer but then computes the remaining writable space incorrectly. The subsequent iconv call writes past the intended boundary, producing an out-of-bounds write on the heap.

Exploitation requires user interaction, because a user must invoke Wget against an attacker-influenced endpoint. Attack complexity is high: the attacker must craft a filename whose conversion trajectory forces the specific E2BIG reallocation path and land useful bytes in adjacent heap chunks. Impact is scoped primarily to availability and, in narrower cases, integrity of the Wget process.

Root Cause

The defect is an arithmetic error in the reallocation branch of the iconv conversion loop. After growing the output buffer, the code updates its length and pointer bookkeeping in a way that overstates the number of bytes still available. Because iconv trusts the size argument supplied by the caller, it continues writing until it has emitted the converted sequence, exceeding the true bounds of the allocation. The fix in commit c2640fe corrects the remaining-space calculation so that subsequent iconv calls respect the actual buffer boundary.

Attack Vector

Delivery occurs over the network. A malicious HTTP or FTP server returns a response whose filename, once passed through convert_fname() with a locale that requires character set conversion, forces the vulnerable reallocation path. Common exposure paths include downloading URLs supplied by untrusted users, mirroring or recursive retrieval against attacker-controlled domains, and following redirects into malicious hosts. See the VulnCheck Security Advisory for the full technical write-up.

Detection Methods for CVE-2026-58471

Indicators of Compromise

Unexpected crashes, SIGABRT, or glibc heap corruption diagnostics (malloc(): corrupted, free(): invalid pointer) originating from wget processes.
Wget invocations against previously unseen or low-reputation hosts returning responses with unusually long or multibyte filenames.
Core dumps from wget on systems with non-ASCII locales such as LANG=zh_CN.UTF-8 or LANG=ja_JP.UTF-8.

Detection Strategies

Inventory installed Wget versions across endpoints and servers, flagging any build at or below 1.25.0 that lacks commit c2640fe.
Monitor process telemetry for wget child processes that terminate abnormally shortly after network activity.
Inspect proxy and web gateway logs for outbound HTTP responses containing filenames with malformed or oversized multibyte sequences.

Monitoring Recommendations

Alert on wget executions launched from build agents, cron jobs, or service accounts that connect to hosts outside an approved allowlist.
Correlate crash telemetry with the parent command line to identify Wget invocations that fetched attacker-controlled URLs.
Track package manager events that install or upgrade the wget binary so remediation status is auditable.

How to Mitigate CVE-2026-58471

Immediate Actions Required

Upgrade GNU Wget to a build that includes commit c2640fe from the upstream GitLab repository.
Apply distribution security updates as soon as vendor packages for Wget become available.
Restrict automated Wget usage to trusted hosts and reject redirects to untrusted domains where feasible.

Patch Information

The fix is upstream commit c2640fe5171c59f87c58dc9fcb195b2d18b010ee, which corrects the remaining-space calculation in convert_fname() after iconv returns E2BIG. Rebuild Wget from source with this commit applied, or install the vendor package that incorporates it. Reference the GitLab commit and the VulnCheck advisory for validation details.

Workarounds

Run Wget in a locale that avoids character set conversion, such as LANG=C or LC_ALL=C, until the patched build is deployed.
Prefer curl or another maintained HTTP client for scripted downloads from untrusted sources during the remediation window.
Sandbox Wget invocations with restricted filesystem and network policies so heap corruption cannot escalate into broader compromise.

bash

# Configuration example: force POSIX locale to bypass iconv conversion path
LC_ALL=C LANG=C wget --max-redirect=0 --trust-server-names=off https://example.com/file