GNU Wget CVE-2026-94574

Requires the Windows build of GNU wget from eternallybored.org (versions 0 through ≤1.21.4) installed on the host. Exploitation depends on the hardcoded configuration path C:\msys64 being writable by unprivileged users (the default insecure condition), local access as a low-privileged user to plant the config, and - critically - a separate higher-privileged user or context subsequently invoking wget so it reads the planted wgetrc and triggers the use_askpass directive (this is the UI:R limiting factor). The attack is not remotely reachable (AV:L) and does not fire on its own; without a privileged victim running the affected wget build, there is no privilege escalation.

The CVSS 3.1 base score of 7.8 (vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly frames this as a LOCAL cross-user code-execution / privilege-escalation issue, not a remote-exploitable flaw - the AV:L is decisive and should temper any alarm raised by the 'RCE' tag, which here means arbitrary code execution locally rather than network RCE. There is no EPSS score, no CISA KEV listing, and no flagged public exploit in the provided data, so all three exploitation signals point to a non-widespread, opportunistic risk profile rather than active mass exploitation. The SSVC/kill-chain reality is that exploitation is neither automatable nor remotely reachable: it requires an attacker to already have an unprivileged foothold on the specific Windows host AND a higher-privileged user (or scheduled/service context) to subsequently run the vulnerable wget build, so it is a credible local-privesc primitive but a lower operational priority than any network-facing HIGH. One inconsistency to verify: the vector uses PR:N (any unprivileged local user can write the config) combined with UI:R (a victim must run wget) - this is internally coherent for a config-planting attack, but note the CWE is listed as N/A despite the description clearly matching CWE-732 (incorrect permissions / user-writable trusted path), so the classification metadata is incomplete. The atos.net reference is a narrative writeup, not a weaponized exploit, so POC availability should be treated as unconfirmed.

On a shared Windows host, a low-privileged attacker writes a malicious wget configuration file to the hardcoded, user-writable C:\msys64 path and includes a use_askpass directive pointing at an attacker-controlled executable. When an administrator or higher-privileged user later runs the eternallybored.org wget build, it loads the planted config and executes the askpass binary in that user's context, yielding cross-user code execution and privilege escalation. No public weaponized exploit is identified in the provided data, though a narrative writeup (atos.net) describes the technique.