GNU Wget CVE-2026-58471

Exploitation requires the target to run GNU Wget version 1.25.0 or earlier compiled with iconv support, and to contact an attacker-controlled server that responds with a filename requiring cross-charset iconv conversion (e.g., a Content-Disposition header containing a filename with multi-byte or non-ASCII characters). The attacker must craft the filename such that its converted form triggers the E2BIG buffer-too-small condition during the reallocation path in convert_fname(). Passive user interaction is required: a user or automated process must initiate the wget download targeting the malicious endpoint. Limiting factors include: (1) AC:H - the attacker must precisely size and encode the server-supplied filename to hit the iconv E2BIG reallocation branch; (2) UI:P - the wget client must be directed at the attacker's server, whether by social engineering or by compromising a trusted source referenced in automated scripts; (3) the target wget binary must have been compiled with iconv support, which is standard in most distribution packages but not universal. There is no requirement for authentication, special Wget configuration flags beyond defaults, or local system access.

The CVSS 4.0 score of 6.0 (vector AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N) reflects several important risk-limiting factors: high attack complexity (AC:H) because triggering the E2BIG reallocation path requires precise character set conversion conditions, and passive user interaction (UI:P) because a user or automated process must initiate a wget download against an attacker-controlled endpoint. The primary confirmed impact is availability (VA:H - process crash); confidentiality is unaffected (VC:N), and integrity impact is limited (VI:L). No EPSS score was provided in the source data and no KEV listing exists, suggesting this is not currently under widespread exploitation. The real-world priority is moderate: wget is widely deployed, and automated scripts (CI/CD pipelines, container builds, provisioning tooling) that download from external or partially trusted servers are plausibly exploitable without direct user awareness. A discrepancy to note: the CVSS 4.0 vector assigns PR:N, which is consistent with the wget client needing no authentication to reach the attacking server, but the attack inherently requires the user to have chosen to contact that server - a social engineering dependency that AC:H and UI:P partly capture.

An attacker operates a malicious HTTP server and serves a response with a Content-Disposition filename containing characters sized and encoded to trigger the iconv E2BIG reallocation branch in convert_fname(). When a user or CI/CD pipeline script runs wget against that URL, convert_fname() allocates an output buffer, receives E2BIG from iconv, attempts to reallocate with a miscalculated offset, and overwrites adjacent heap memory - crashing the process or, under favorable heap conditions, achieving limited write primitives. No public proof-of-concept has been identified at time of analysis.