Heap Buffer Overflow in GNU Wget Affects Memory Handling

CVE-2026-58472

What is CVE-2026-58472?

GNU Wget, up to version 1.25.0, contains a heap buffer overflow vulnerability within the html_quote_string() function located in src/convert.c. An attacker can exploit this flaw by sending a specially crafted HTML attribute with an excessive character count that necessitates entity encoding. The exploitation process involves triggering a signed integer counter overflow during the size accumulation phase, which leads to an inadequate heap allocation. This misallocation can result in a heap buffer overflow in the subsequent memory copy operation, thereby allowing attackers to corrupt memory and potentially execute arbitrary code.

References