Heap Buffer Overflow in GNU Wget

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: VulnCheck

Description

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-58472

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	wget	1.25.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability exists in GNU Wget through version 1.25.0 in the html_quote_string() function located in src/convert.c. It is a heap buffer overflow caused when a remote attacker supplies a specially crafted HTML attribute containing a large number of characters that require entity encoding.

The issue arises because a signed integer counter overflows during the calculation of the output size, leading to an undersized heap allocation. When the program copies data into this undersized buffer, it causes a heap buffer overflow, potentially corrupting memory.

Impact Analysis

This vulnerability can lead to memory corruption due to the heap buffer overflow. Such memory corruption can cause the program to crash or behave unpredictably.

In some cases, attackers might exploit this to execute arbitrary code or cause denial of service, depending on the context in which GNU Wget is used and the environment it runs in.

Hi! I’m here to help you understand CVE-2026-58472. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70