Vulnerability · Published Jul 7, 2026 · Assigned by VulnCheck
CVE-2026-58471GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c
Medium 5.9
In plain English
A medium-severity heap buffer overflow in wget from gnuwget. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | wget | 1.24.5-8.el10_2 | ALSA-2026:62142 |
| AlmaLinux:8 | wget | 1.19.5-16.el8_10 | ALSA-2026:62144 |
| AlmaLinux:9 | wget | 1.21.1-11.el9_8 | ALSA-2026:62143 |
| Debian:12 | wget | no fix listed | DEBIAN-CVE-2026-58471 |
| Debian:13 | wget | no fix listed | DEBIAN-CVE-2026-58471 |
| Debian:14 | wget | no fix listed | DEBIAN-CVE-2026-58471 |
| Rocky Linux:10 | wget | 0:1.24.5-8.el10_2 | RLSA-2026:62142 |
| Rocky Linux:8 | wget | 0:1.19.5-16.el8_10 | RLSA-2026:62144 |
| Rocky Linux:9 | wget | 0:1.21.1-11.el9_8 | RLSA-2026:62143 |
| Ubuntu:22.04:LTS | wget | 1.21.2-2ubuntu1.3 | UBUNTU-CVE-2026-58471 |
| Ubuntu:22.04:LTS | wget | 1.21.2-2ubuntu1.3 | USN-8543-1 |
| Ubuntu:24.04:LTS | wget | 1.21.4-1ubuntu4.3 | USN-8543-1 |
| Ubuntu:24.04:LTS | wget | 1.21.4-1ubuntu4.3 | UBUNTU-CVE-2026-58471 |
| Ubuntu:25.10 | wget | no fix listed | UBUNTU-CVE-2026-58471 |
| Ubuntu:26.04:LTS | wget | 1.25.0-2ubuntu4.2 | USN-8543-1 |
| Ubuntu:26.04:LTS | wget | 1.25.0-2ubuntu4.2 | UBUNTU-CVE-2026-58471 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
References
- Fix Commit patch
- https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-convert-fname-in-url-c third-party-advisory