CVE-2026-94574: GNU wget Windows RCE Vulnerability

CVE-2026-94574 Overview

CVE-2026-94574 is a local cross-user code execution vulnerability in the Windows build of GNU wget distributed by eternallybored.org. The binary reads its configuration from a hardcoded path (C:\msys64) that is writable by unprivileged users. An attacker with low-privilege local access can plant a malicious wgetrc file that abuses the use_askpass directive to execute arbitrary code when another user, including an administrator, runs wget. Successful exploitation results in local privilege escalation on the affected host.

Critical Impact

An unprivileged local user can achieve arbitrary code execution in the context of any other user who invokes the affected wget binary, enabling privilege escalation to administrator.

Affected Products

• GNU wget for Windows distributed via eternallybored.org
• Windows systems where C:\msys64 exists and is writable by unprivileged users
• Environments bundling the affected wget build into scripts or scheduled tasks

Discovery Timeline

• 2026-09-22 - CVE-2026-94574 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94574

Vulnerability Analysis

The affected wget.exe build hardcodes C:\msys64 as a search location for its runtime configuration file. On standard Windows installations, directories created under the root of C:\ inherit permissions that grant BUILTIN\Users write access unless explicitly restricted. This allows any interactive user to create or modify files inside C:\msys64, including a wgetrc configuration file consumed by wget at startup.

wget supports a use_askpass directive that specifies an external helper program invoked to retrieve credentials. Because the configuration is read before authentication, and the referenced helper path is executed by the calling process, an attacker who controls wgetrc controls which binary runs and in whose security context.

Root Cause

The root cause is an insecure default configuration search path combined with unsafe deserialization of user-controlled configuration input. The Windows build resolves configuration files from a location that is not protected by administrative access control lists. This creates a classic untrusted-search-path issue where a low-integrity user can influence code execution for high-integrity callers.

Attack Vector

Exploitation requires local access and user interaction from a victim who launches wget. The attacker writes a crafted wgetrc into C:\msys64 containing a use_askpass directive that points at an attacker-controlled executable. When any other user, including an administrator or a scheduled task running as SYSTEM, invokes wget, the askpass helper is spawned in the caller's security context. This yields cross-user code execution and enables privilege escalation.

No authentication or network access is required. The attack does not need elevated privileges to plant the payload. See the Atos Cybersecurity Article for the disclosed research context and the Eternally Bored Wget Tool page for distribution details.

Detection Methods for CVE-2026-94574

Indicators of Compromise

• Presence of a wgetrc file or any unexpected file under C:\msys64 on hosts where MSYS2 was not intentionally installed
• wgetrc entries containing a use_askpass directive that references a binary outside standard system paths
• Child processes of wget.exe that do not correspond to network transfer activity, such as cmd.exe, powershell.exe, or unsigned binaries

Detection Strategies

• Hunt for process-creation events where wget.exe spawns an interpreter or a binary located in a user-writable directory
• Alert on file-write events targeting C:\msys64\wgetrc or new file creations under C:\msys64 by non-administrative users
• Correlate wget.exe executions across user contexts to identify cases where a low-privileged user's configuration influenced a high-privileged run

Monitoring Recommendations

• Enable Windows command-line auditing (Event ID 4688) to capture the full wget.exe invocation and any spawned helper process
• Monitor directory ACL changes on C:\msys64 and alert on ACL weakening that grants write to BUILTIN\Users
• Baseline expected wget.exe deployment paths and flag executions from non-approved locations

How to Mitigate CVE-2026-94574

Immediate Actions Required

• Remove the eternallybored.org wget.exe build from systems where it is not required, or replace it with a build that does not resolve configuration from C:\msys64
• If C:\msys64 is not needed, delete the directory and confirm no residual files remain
• If C:\msys64 must exist, restrict its ACL so only administrators can write, then audit for any existing wgetrc
• Inventory scheduled tasks, login scripts, and CI runners that call wget.exe and validate the resolved binary path

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Consult the Eternally Bored Wget Tool distribution page for updated builds and mitigation guidance from the maintainer.

Workarounds

• Apply a restrictive ACL to C:\msys64 that removes write permissions for BUILTIN\Users and Authenticated Users
• Set a WGETRC environment variable pointing to an administrator-controlled configuration path to override the default lookup
• Block execution of wget.exe outside approved directories using Windows Defender Application Control or AppLocker
• Replace usage with curl.exe, which ships natively in supported Windows versions, where operationally acceptable

# Example: restrict C:\msys64 so only Administrators can write
icacls C:\msys64 /inheritance:r
icacls C:\msys64 /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"

# Optional: pin wget to an administrator-owned configuration file
setx /M WGETRC "C:\ProgramData\wget\wgetrc"