GNU Wget EUVD-2026-42081

Exploitation requires that the victim uses a Metalink-enabled Wget build AND actively retrieves a Metalink document from a server the attacker controls, has compromised, or can redirect the victim toward; the malicious trigger is a Metalink URL element consisting entirely of whitespace. Limiting factors: Wget must be compiled with Metalink support and be processing Metalink content (not a default plain single-file fetch), the victim must initiate the connection to the attacker-controlled server, and the confirmed impact is limited to availability (a crash / abnormal behavior) with no vendor-credited code execution or confidentiality impact.

The vendor CVSS 4.0 score is 8.7 with a vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) that scores only availability impact - consistent with the description, which states 'abnormal program behavior' (a crash), not code execution or data disclosure. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low: this is a client-side crash requiring the victim to point Wget at an attacker-controlled server with Metalink processing active, not a server-side or wormable flaw. The score's PR:N/UI:N framing overstates opportunistic risk for a tool that a user must deliberately invoke against a hostile endpoint; treated as a moderate-priority hardening patch rather than an emergency. Note a tension in the data: the input Tags include 'Information Disclosure' and 'Buffer Overflow', but the CVSS impact metrics set confidentiality (VC:N) to none and describe only availability impact - an underread could in principle read adjacent memory, but the vendor did not credit a confidentiality impact, so info-disclosure should be treated as unverified.

An attacker who controls or has compromised a download server (or can MITM/redirect a victim's Wget request) serves a Metalink document whose URL field contains only spaces or tabs. When the victim runs Wget with Metalink processing against that server, clean_metalink_string() reads before the start of the heap buffer, causing the process to behave abnormally or crash. No public exploit code was identified at time of analysis, and the demonstrated impact is denial of service rather than code execution.