Heap Buffer Underread in GNU Wget

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: VulnCheck

Description

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-58469

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	wget	1.25.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in GNU Wget versions up to 1.25.0 in the clean_metalink_string() function located in src/metalink.c. It is a heap buffer underread issue that occurs when a malicious server provides a Metalink document containing a URL made up entirely of whitespace characters. When processing such a URL, the function may decrement a pointer beyond the start of the allocated buffer, leading to memory corruption and potentially causing abnormal program behavior.

Impact Analysis

The impact of this vulnerability is that an attacker controlling a malicious server can cause memory corruption in GNU Wget by serving a specially crafted Metalink document. This can lead to abnormal program behavior, which might include crashes or other unintended actions. Since the vulnerability does not require user interaction or privileges, it can be exploited remotely and silently.

Hi! I’m here to help you understand CVE-2026-58469. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70