GNU Wget CVE-2026-58472

Exploitation requires that a victim user or automated process runs GNU Wget version 1.25.0 or earlier to download content from an attacker-controlled server. The server must return an HTML response (not a binary or plain-text download) containing an attribute value with a sufficiently large number of characters requiring HTML entity encoding to trigger the integer overflow in html_quote_string(). The CVSS UI:P metric confirms that user interaction is required - the victim must initiate the wget request. AC:H indicates non-trivial alignment of conditions (specific HTML content and attribute size thresholds). Exploitation is bounded by three concrete requirements: wget version ≤ 1.25.0; the HTML link conversion code path being exercised on the server's response; and the attribute containing enough entity-encodable characters to overflow the signed integer accumulator. Automated wget invocations in CI/CD pipelines or container build scripts that fetch from third-party or user-supplied URLs represent the highest-risk deployment pattern. Scripts that exclusively download binary files or content from fully trusted, controlled servers are not affected by this code path.

The CVSS 4.0 score of 6.0 with vector AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N reflects realistic exploitation constraints accurately. High attack complexity (AC:H) and required user interaction (UI:P) are the dominant risk reducers - a victim must actively run wget against an attacker-controlled server, and that server must deliver a precisely crafted HTML attribute triggering the integer overflow in the conversion path. The primary confirmed impact is availability (VA:H), most likely a process crash; while heap overflows can sometimes be elevated to code execution through heap grooming, this requires additional exploitation sophistication and is not confirmed. No EPSS score was provided in the input data, no CISA KEV listing exists, and no public proof-of-concept has been identified, suggesting no observed mass exploitation at time of analysis. The realistic risk is highest in automated pipelines or scripts that invoke wget against third-party or user-supplied URLs; interactive usage against trusted sources presents minimal practical risk. This is a medium-priority remediation: apply the upstream fix at the next maintenance cycle, prioritizing environments that use wget in CI/CD automation or that fetch content from untrusted origins.

An attacker operates a malicious web server and lures a victim user or automated script to run wget against a URL on that server. The server responds with an HTML page containing an attribute value composed of thousands of characters requiring HTML entity encoding; when wget processes this response through its link-conversion code, the signed integer counter in html_quote_string() overflows, an undersized heap buffer is allocated, and the copy phase writes beyond it - crashing the wget process or, in a more sophisticated heap-layout attack, potentially redirecting execution. No public proof-of-concept exploit has been identified at time of analysis.