CVE-2026-58472: GNU Wget Buffer Overflow Vulnerability

CVE-2026-58472 Overview

CVE-2026-58472 is a heap buffer overflow in GNU Wget through version 1.25.0, caused by an integer overflow [CWE-190] in the html_quote_string() function located in src/convert.c. A remote server can supply a crafted HTML attribute containing a large number of characters that require entity encoding. The signed integer counter used to compute the output size overflows, producing an undersized heap allocation. Wget then writes the fully encoded string into that undersized buffer, corrupting adjacent heap memory. The issue is fixed in commit dd692d9.

Critical Impact
A malicious HTTP server can corrupt heap memory in a Wget client that performs link conversion, enabling denial of service and potential code execution on the client host.

Affected Products

GNU Wget versions up to and including 1.25.0
Downstream Linux distributions and container images shipping vulnerable Wget builds
Automation, CI/CD, and scripting environments that invoke Wget with --convert-links or related HTML processing options

Discovery Timeline

2026-07-07 - CVE-2026-58472 published to NVD
2026-07-09 - Last updated in NVD database
Fix commit - dd692d9cea5335b181d877ae917fe6e75587a812 merged into the GNU Wget repository

Technical Details for CVE-2026-58472

Vulnerability Analysis

GNU Wget uses html_quote_string() in src/convert.c to HTML-entity-encode attribute values when rewriting downloaded documents. The function first walks the input string to compute the size of the encoded output, then allocates a heap buffer of that size, then performs the copy while expanding characters such as &, <, >, ", and ' into their multi-byte entity forms.

The size accumulator is a signed integer. When an attacker-controlled HTML attribute contains enough entity-triggering characters, the running total exceeds INT_MAX and wraps to a small or negative value. The subsequent allocation is therefore much smaller than the data that will be written. The copy phase then overruns the allocation, corrupting heap metadata and adjacent chunks.

Exploitation requires user interaction: the victim must run Wget against an attacker-controlled or attacker-influenced URL, typically with options that trigger HTML parsing and link conversion. Successful exploitation can crash the process and, depending on allocator state, permit control-flow hijack.

Root Cause

The root cause is unchecked signed integer arithmetic during output length calculation. The counter is incremented per expanded character without bounds validation, and the allocation call uses the wrapped value directly. The fix in commit dd692d9 introduces safe accumulation and validates the computed length before allocation.

Attack Vector

The vector is network-based but requires user participation. An attacker hosts a document containing an HTML attribute engineered to overflow the length counter, then induces a victim to fetch it with Wget using an option path that reaches html_quote_string(). Redirects from a benign host to an attacker host also satisfy this condition.

No verified public exploit code is available. See the VulnCheck Advisory on Wget Overflow and the GitLab Wget Commit Update for technical details.

Detection Methods for CVE-2026-58472

Indicators of Compromise

Wget process crashes or SIGABRT/SIGSEGV terminations correlated with heap corruption messages such as malloc(): corrupted or free(): invalid pointer
HTTP responses containing HTML attributes with abnormally long runs of entity-triggering characters such as &, <, >, ", or '
Wget executions launched with --convert-links, -k, --mirror, or recursive fetch flags against untrusted hosts

Detection Strategies

Inventory installed Wget binaries across Linux endpoints and container images and flag versions at or below 1.25.0
Monitor for Wget child processes spawned by CI/CD runners, cron jobs, and application service accounts fetching external URLs
Inspect HTTP response bodies at proxies for HTML attributes exceeding realistic length thresholds, particularly those densely populated with encodable characters

Monitoring Recommendations

Collect process telemetry for wget invocations including full command line and parent process, and forward to a SIEM for correlation
Alert on Wget crashes followed by unexpected child processes or outbound network connections from the same host
Track package versions of wget through configuration management and vulnerability scanning to confirm patch deployment

How to Mitigate CVE-2026-58472

Immediate Actions Required

Upgrade GNU Wget to a build that includes commit dd692d9 or the corresponding distribution security update
Restrict Wget usage in automated pipelines to allowlisted hosts until patched builds are deployed
Avoid running Wget with --convert-links, -k, or recursive mirroring flags against untrusted or user-supplied URLs

Patch Information

The fix is applied in upstream commit dd692d9cea5335b181d877ae917fe6e75587a812 in the GNU Wget repository. Rebuild from source at or above this commit, or install the corresponding vendor package update from your Linux distribution. Reference: GitLab Wget Commit Update.

Workarounds

Substitute curl for Wget in scripts that fetch untrusted content, since curl does not perform HTML link rewriting
Run Wget under a restricted, non-privileged user account with no write access to sensitive paths
Disable HTML processing options and use plain wget <url> -O <file> to fetch content without invoking html_quote_string()
Route Wget traffic through an inspecting proxy that enforces response size and attribute length limits

bash

# Verify installed Wget version and check against fixed commit
wget --version | head -n 1

# Debian/Ubuntu: apply distribution security update
sudo apt-get update && sudo apt-get install --only-upgrade wget

# RHEL/CentOS/Fedora
sudo dnf upgrade wget

# Safer invocation pattern for untrusted URLs (no link conversion)
wget --no-config -O /tmp/out.bin "https://example.invalid/resource"