Heap Buffer Overflow in GNU Wget 1.25.0 html_quote_string() (convert.c)
CVE-2026-58472 Published on July 7, 2026
GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding
GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.
Vulnerability Analysis
CVE-2026-58472 is exploitable with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and a high impact on availability.
Weakness Type
Integer Overflow or Wraparound
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. An integer overflow or wraparound occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may wrap to become a very small or negative number. While this may be intended behavior in circumstances that rely on wrapping, it can have security consequences if the wrap is unexpected. This is especially the case if the integer overflow can be triggered using user-supplied inputs. This becomes security-critical when the result is used to control looping, make a security decision, or determine the offset or size in behaviors such as memory allocation, copying, concatenation, etc.
Products Associated with CVE-2026-58472
stack.watch emails you whenever new vulnerabilities are published in GNU Wget or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
gnuwget wget:- Before and including 1.25.0 is affected.
- Version dd692d9cea5335b181d877ae917fe6e75587a812 is unaffected.