Executive brief
GNU Wget, a widely used command-line tool for downloading files from the web, is vulnerable to a memory corruption issue when processing certain web pages. A malicious server can provide a specially crafted file containing a large number of specific HTML characters that causes Wget to crash or behave unexpectedly. This could lead to service disruptions or potentially allow further unauthorized actions on the system running Wget.
Technical details
A heap buffer overflow exists in GNU Wget through version 1.25.0 within the html_quote_string() function in src/convert.c. The vulnerability is rooted in an integer overflow (CWE-190) where a signed integer counter is used to accumulate the required size for HTML entity encoding. When a remote server provides a crafted HTML attribute with a massive number of characters requiring encoding (such as quotes or brackets), the counter wraps around, leading to an undersized heap allocation via xmalloc(). Subsequent copying of the encoded string into this undersized buffer results in a heap-based buffer overflow. This attack requires the user to connect to a malicious server or download a malicious HTML file. The issue was fixed in commit dd692d9 by implementing proper overflow checks during size accumulation.
Affected products
- GNU Wget through 1.25.0
Timeline
- 2026-06-29: patched: Fix authored in commit dd692d9cea5335b181d877ae917fe6e75587a812
- 2026-07-07: disclosed: Vulnerability published by VulnCheck and NVD