CVE-2025-69195: Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
Other sources
Stack-based buffer overflow vulnerability in the filename sanitization logic of GNU Wget2. The flaw occurs when wget2 processes attacker-controlled URL paths while filename restriction options such as --restrict-file-names=windows, unix, or ascii are enabled. During sanitization, the application writes beyond a fixed 1024-byte stack buffer due to missing bounds checks. A specially crafted URL path or HTTP redirect can trigger memory corruption, resulting in a crash or potentially enabling further exploitation. The issue can be triggered remotely with no authentication, requiring only user interaction to invoke wget2.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69195?
CVE-2025-69195 is classified as a critical vulnerability due to its potential for exploitation through a stack-based buffer overflow.
How do I fix CVE-2025-69195?
To fix CVE-2025-69195, update GNU Wget2 to the latest version where the vulnerability has been patched.
What are the potential impacts of CVE-2025-69195?
The potential impacts of CVE-2025-69195 include remote code execution or a denial of service due to the buffer overflow.
Who is affected by CVE-2025-69195?
CVE-2025-69195 affects users of GNU Wget2, particularly those using filename restriction options.
Can CVE-2025-69195 be exploited remotely?
Yes, CVE-2025-69195 can be exploited remotely by attackers through specially crafted URL paths.