CVE-2026-58471: GNU Wget Heap Buffer Overflow in Filename Conversion

Technical summary

The vulnerability exists in the convert_fname() function within src/url.c, which handles character set conversion for filenames using the iconv library. When iconv encounters an E2BIG error (output buffer too small), the code reallocates a larger buffer but miscalculates the remaining space for subsequent conversion operations. This arithmetic error allows iconv to write past the heap buffer's actual bounds. The flaw is triggered when a server supplies a filename that requires character set conversion and the initial buffer proves insufficient after reallocation. The vulnerability was resolved in commit c2640fe of the GNU Wget repository.

Business impact

For organizations relying on Wget for automated downloads, backups, or build pipelines, this vulnerability could disrupt operations if exploited against trusted internal servers or if users are social-engineered into downloading from attacker-controlled hosts. The memory corruption could lead to Wget crashing mid-transfer, causing incomplete downloads and potential data loss. In automated scenarios without user supervision, silent memory corruption is theoretically possible, though the requirement for filename-based triggers limits blast radius compared to network-level exploits. Organizations with Wget in air-gapped or restricted environments face lower risk, while those with end-users using Wget directly should prioritize patching.

Affected systems

GNU Wget versions through 1.25.0 are affected. The vulnerability is present in all builds that include the vulnerable convert_fname() function. Systems using Wget as a dependency in scripts, package managers, or download automation are in scope. Notably, this includes many Linux distributions that bundle Wget as a standard utility, embedded systems using Wget for updates, and CI/CD pipelines that rely on Wget for artifact retrieval. Custom builds or downstream distributions that have backported a fix to an older version would not be vulnerable; verify the specific commit history of your deployed version.

Exploitability

The attack requires an attacker to control or compromise a web/FTP server that a Wget user connects to, or to perform a man-in-the-middle attack on an unencrypted connection. The attacker then crafts a filename that triggers character set conversion and buffer reallocation. User interaction is required—someone must initiate the download or the automation must be configured to connect to the attacker's server. These constraints place exploitability in the 'difficult' category; this is not a wormable or network-propagating flaw. The CVSS vector (AC:H) reflects the requirement for specific environmental conditions. Exploitation is feasible for targeted attacks against high-value targets or for triggering denial-of-service in batch download scenarios, but mass exploitation is unlikely.

Remediation

Apply the fix from GNU Wget's main development branch (commit c2640fe or later). For distribution packages, wait for your OS vendor to release an updated Wget version and apply it via standard package management. If you maintain custom Wget builds, cherry-pick the relevant patch or upgrade to the next stable release once available. In the interim, consider restricting Wget downloads to trusted, internal servers, enforcing HTTPS with certificate pinning where possible to reduce man-in-the-middle risk, and disabling automatic filename conversion if your use case permits. For automated systems, implement integrity checks on downloaded files to detect corruption.

Patch guidance

Monitor GNU Wget's official release channels (https://savannah.gnu.org/projects/wget/) for the next stable release incorporating commit c2640fe. Distributors such as Debian, Ubuntu, Red Hat, and Alpine will release patched versions through their respective repositories. Once available, apply updates via your standard patch management process. Verify the patch by checking that your deployed Wget version matches or exceeds the patched commit. For users compiling from source, fetch the latest code from the official repository and rebuild. Testing the patch in a staging environment with files requiring character conversion is advisable to confirm the fix.

Detection guidance

Monitor system logs and application output for Wget crashes, segmentation faults, or unexpected terminations, particularly when downloading files with non-ASCII characters in filenames or when connecting to unusual servers. Network detection is difficult without visibility into server responses; focus on endpoint telemetry. Check your Wget version using `wget --version` and cross-reference against known affected versions. In centralized logging, search for error messages related to iconv or memory allocation failures emanating from Wget processes. If you maintain a file integrity monitoring system, look for unexpected heap corruption signatures in process crash dumps. Implement alerting on any Wget process terminating with a segmentation fault.

Why prioritize this

This vulnerability warrants prioritization in patching cycles because Wget is pervasive across Linux infrastructure, particularly in automation and packaging scenarios where unattended downloads occur. The CVSS score of 5.9 (MEDIUM) reflects the requirement for user interaction and difficult exploitation conditions, but the combination of memory corruption and automation risk argues for faster-than-typical MEDIUM-severity patching. Organizations with Wget integrated into CI/CD, package managers, or mirror systems should patch within their standard critical-update window. Those using Wget only for ad-hoc manual downloads can follow a more relaxed timeline, though patching within 30 days remains prudent.

Risk score, explained

The CVSS 3.1 score of 5.9 is driven by a network attack vector (AV:N), high complexity (AC:H due to the need for specific filename conditions and user interaction), no privilege escalation, no confidentiality impact (C:N), limited integrity impact (I:L—file corruption, not system compromise), and high availability impact (A:H—process crash). The AC:H and UI:R components significantly reduce severity despite the network attack surface. This is neither a critical remote code execution nor a trivial local issue; it sits squarely in the medium range for severity but requires active monitoring and timely patching to avoid operational disruption.

Frequently asked questions