CVE-2026-58472

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.25.0 commit dd692d9

Description A heap buffer overflow occurs in the html quote string() function within src/convert.c. A remote attacker can trigger memory corruption by providing a crafted HTML attribute containing a large number of characters that require entity encoding. This causes a signed integer counter to overflow during the accumulation of the output size, leading to an undersized heap allocation and a subsequent buffer overflow during the copy phase.

Recommendations Update GNU Wget to the version containing commit dd692d9.