Is CVE-2026-58472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58472 being exploited in the wild.

How severe is CVE-2026-58472?

Medium severity, with a CVSS score of 5.9, published 7 July 2026.

Is there a fix for CVE-2026-58472?

A patch was published on 2026-06-29: Fix authored in commit dd692d9cea5335b181d877ae917fe6e75587a812 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58472 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58472?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58472: GNU Wget heap buffer overflow in html_quote_string

CVE-2026-58472 · Severity: medium · CVSS 5.9 · Published 2026-07-07

GNU Wget, a widely used command-line tool for downloading files from the web, is vulnerable to a memory corruption issue when processing certain web pages. A malicious server can provide a specially crafted file containing a large number of specific HTML characters that causes Wget to crash or behave unexpectedly. This could lead to service disruptions or potentially allow further unauthorized actions on the system running Wget.

Quick answers

Is CVE-2026-58472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58472 being exploited in the wild.
How severe is CVE-2026-58472?: Medium severity, with a CVSS score of 5.9, published 7 July 2026.
Which products and versions are affected?: GNU Wget through 1.25.0.
Is there a fix for CVE-2026-58472?: A patch was published on 2026-06-29: Fix authored in commit dd692d9cea5335b181d877ae917fe6e75587a812 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58472 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58472?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer overflow exists in GNU Wget through version 1.25.0 within the html_quote_string() function in src/convert.c. The vulnerability is rooted in an integer overflow (CWE-190) where a signed integer counter is used to accumulate the required size for HTML entity encoding. When a remote server provides a crafted HTML attribute with a massive number of characters requiring encoding (such as quotes or brackets), the counter wraps around, leading to an undersized heap allocation via xmalloc(). Subsequent copying of the encoded string into this undersized buffer results in a heap-based buffer overflow. This attack requires the user to connect to a malicious server or download a malicious HTML file. The issue was fixed in commit dd692d9 by implementing proper overflow checks during size accumulation.

Affected products

GNU Wget through 1.25.0

Timeline

2026-06-29: patched: Fix authored in commit dd692d9cea5335b181d877ae917fe6e75587a812
2026-07-07: disclosed: Vulnerability published by VulnCheck and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.