CVE-2026-58472

What it actually does

GNU Wget through 1.25.0 contains a heap buffer overflow in html_quote_string() in src/convert.c. When Wget processes attacker-supplied HTML and rewrites/quotes an HTML attribute containing a very large number of characters that require entity encoding, a signed integer used to calculate the encoded output length can overflow. Wget then allocates a heap buffer that is too small and overflows it during the copy/encoding phase. The most likely impact is process crash and denial of service; memory corruption creates theoretical risk of more serious outcomes, but exploitation is high-complexity and no public exploit maturity is reported.

Why it matters to the business

Organizations that use Wget in automation, mirroring, crawling, software-fetching workflows, or operational scripts could have those jobs crashed by a malicious or compromised web server. If Wget runs in privileged or business-critical automation, the issue could interrupt deployments, backups, content ingestion, monitoring, or data collection. The risk is currently moderate: the vulnerability is network-reachable through attacker-controlled content but requires a particular Wget processing path and user or automation interaction; EPSS is low and it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first hosts or injects a malicious HTML page containing an attribute value with an extremely large number of characters that expand during HTML entity encoding. The attacker then gets a victim, scheduled job, crawler, mirror, or script to retrieve that page with GNU Wget in a mode that processes and converts HTML content. During conversion, Wget calls html_quote_string() on the attacker-controlled attribute. The encoded-length counter overflows, causing Wget to allocate an undersized heap buffer. When the attribute is copied into that buffer in encoded form, Wget writes past the heap allocation. In practical terms this is expected to crash the Wget process or corrupt memory; reliable arbitrary code execution has not been demonstrated based on the provided maturity information.

How to fix it

Upgrade GNU Wget to a vendor package or upstream build that includes the fix from commit dd692d9. Treat GNU Wget through 1.25.0 as affected until the maintainers or OS distribution confirm a fixed release/package. Where immediate upgrade is not possible, reduce exposure by avoiding HTML conversion/link-rewriting features on untrusted content, especially options such as --convert-links or -k in automated mirroring/crawling jobs; run Wget as an unprivileged user; execute download jobs in a sandbox/container; apply memory and process restart limits; and restrict automated Wget access to trusted domains where feasible.

How to confirm the fix worked

Confirm the installed Wget build is newer than the affected code line or that the vendor package changelog/backport references the fix for the heap buffer overflow in html_quote_string() or upstream commit dd692d9. Inventory systems and containers for GNU Wget versions through 1.25.0, including embedded copies in build images and automation runners. Review scripts, cron jobs, CI jobs, and service units for Wget usage with HTML conversion or mirroring options. After patching, rerun version/package checks and confirm automation still functions without crashes when processing large or unusual HTML attributes.

Typical attack path

1. Attacker controls a web server, compromised site, redirect target, or network position capable of supplying HTML to Wget.
2. Attacker crafts an HTML document with an attribute containing a very large number of characters that require entity encoding.
3. Victim user, script, crawler, or mirror job retrieves the content using GNU Wget through 1.25.0 in a mode that performs HTML conversion or link rewriting.
4. Wget processes the malicious attribute in html_quote_string().
5. A signed integer overflow causes Wget to allocate a buffer smaller than required for the encoded output.
6. The copy phase writes beyond the heap buffer, causing memory corruption and likely process termination.
7. Attacker achieves denial of service against the Wget process or associated automation; more advanced exploitation would require overcoming heap-layout and reliability constraints.

How to detect it

Look for evidence of Wget processing attacker-controlled HTML immediately before crashes or abnormal terminations. Useful sources include process execution telemetry, shell history, cron/systemd timers, CI job logs, EDR process events, web proxy logs, network egress logs, kernel logs, crash reporters, and core dump directories. Focus on Wget executions that include HTML conversion or mirroring behavior, followed by segmentation faults, heap corruption messages, aborts, or core dumps. Correlate crash timestamps with outbound HTTP/HTTPS requests and redirects to unusual or newly contacted domains. If memory-safety tooling is present, search sanitizer logs for heap-buffer-overflow reports involving html_quote_string() or src/convert.c. There are no known public attacker infrastructure indicators from the provided data, so detection should be behavior- and artifact-based rather than IP/domain-based.

• html_quote_string
• src/convert.c
• AddressSanitizer: heap-buffer-overflow
• heap-buffer-overflow
• Segmentation fault
• core dumped
• malloc(): corrupted top size
• double free or corruption
• corrupted size vs. prev_size
• wget --convert-links
• wget -k
• wget --mirror
• wget -m
• core.wget
• wget.core

What your security team should do

• Prioritize patching systems that run Wget automatically against external or user-controlled URLs, especially crawlers, mirrors, CI/CD runners, ingestion pipelines, and download automation.
• Inventory GNU Wget installations and flag versions through 1.25.0 or packages lacking the dd692d9 fix.
• Search scripts, scheduled tasks, containers, and CI definitions for Wget invocations using --convert-links, -k, --mirror, or recursive retrieval against untrusted sites.
• Until patched, run Wget jobs with least privilege and sandboxing, and avoid HTML conversion of untrusted content.
• Monitor for Wget crashes, core dumps, abnormal exits, and repeated failures after retrieving HTML from the same external source.
• Because EPSS is low, KEV is false, and no public exploit maturity is reported, handle as a targeted hardening and reliability issue rather than an active mass-exploitation emergency unless local exposure is high.