CVE-2026-58471

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.25.0 commit c2640fe

Description A heap buffer overflow occurs in the convert fname() function within src/url.c. This issue is triggered when a server-supplied filename requires character set conversion and the output buffer is too small during iconv E2BIG reallocation. The reallocation logic miscalculates the remaining space, allowing a remote attacker to cause memory corruption via a maliciously crafted server response. iconv E2BIG is an error code indicating that the output buffer is too small to hold the converted string.

Recommendations Update to the version containing commit c2640fe.