CVE-2026-58471: GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convertfname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Wgetto a version that resolves this vulnerability.Fixed in 1.25.0Patch c2640fe - Compensating control
If you cannot immediately update, mitigate by preventing the vulnerable GNU Wget convert_fname() path from processing server-supplied filenames requiring character set conversion (e.g., avoid downloads that trigger charset conversion, or restrict/validate the filenames in a proxy/wrapper before invoking Wget).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58471?
The severity of CVE-2026-58471 is medium with a score of 5.9.
How do I fix CVE-2026-58471?
To fix CVE-2026-58471, upgrade GNU Wget to version 1.25.1 or later, which includes the necessary security patch.
What is the impact of CVE-2026-58471?
CVE-2026-58471 allows remote attackers to exploit a heap buffer overflow in GNU Wget, leading to potential memory corruption.
Which function is affected by CVE-2026-58471?
The convert_fname() function within src/url.c is affected by CVE-2026-58471.
In which versions of GNU Wget does CVE-2026-58471 exist?
CVE-2026-58471 exists in GNU Wget versions up to and including 1.25.0.