CVE-2026-58471

A flaw was found in GNU Wget. A remote attacker can exploit a heap buffer overflow vulnerability in the convert_fname() function. This occurs when processing a server-supplied filename that requires character set conversion, leading to memory corruption due to incorrect buffer reallocation. This can result in a denial of service or other impacts.

Moderate: A heap buffer overflow in GNU Wget, affecting Red Hat Enterprise Linux and other products, can be triggered by a remote attacker. This flaw occurs when wget processes a specially crafted server-supplied filename that requires character set conversion, leading to memory corruption. Successful exploitation requires user interaction with a malicious server and could result in a denial of service or potentially other impacts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, always use the -O (or --output-document) flag in your scripts to explicitly define the local filename. This forces wget to ignore the server's provided filename, completely bypassing the vulnerable code path.