Log in Start free

Vulnerability · Published Jul 7, 2026 · Assigned by VulnCheck

CVE-2026-58469GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing

High 7.5

In plain English

A high-severity out-of-bounds read in wget from gnuwget. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8wget1.19.5-16.el8_10ALSA-2026:62144
Debian:12wgetno fix listedDEBIAN-CVE-2026-58469
Debian:13wgetno fix listedDEBIAN-CVE-2026-58469
Debian:14wgetno fix listedDEBIAN-CVE-2026-58469
Rocky Linux:8wget0:1.19.5-16.el8_10RLSA-2026:62144
Ubuntu:22.04:LTSwget1.21.2-2ubuntu1.3USN-8543-1
Ubuntu:22.04:LTSwget1.21.2-2ubuntu1.3UBUNTU-CVE-2026-58469
Ubuntu:24.04:LTSwget1.21.4-1ubuntu4.3UBUNTU-CVE-2026-58469
Ubuntu:24.04:LTSwget1.21.4-1ubuntu4.3USN-8543-1
Ubuntu:25.10wgetno fix listedUBUNTU-CVE-2026-58469
Ubuntu:26.04:LTSwget1.25.0-2ubuntu4.2UBUNTU-CVE-2026-58469
Ubuntu:26.04:LTSwget1.25.0-2ubuntu4.2USN-8543-1

Affected products (as reported)

VendorProductVersions
gnuwget wget 0 – through 1.25.0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References