CVE-2026-58471— GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58471
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c
Source: NVD (National Vulnerability Database)
Vulnerability Description
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
堆缓冲区溢出
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-58471
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58471
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-58471 (1)
Vendor Advisories for CVE-2026-58471 (1)
Same Patch Batch · gnuwget · 2026-07-07 · 4 CVEs total
| CVE-2026-58469 | 7.5 HIGH | GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing |
| CVE-2026-58472 | 5.9 MEDIUM | GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding |
| CVE-2026-58470 | 5.3 MEDIUM | GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing |
IV. Related Vulnerabilities
Same product: wget
- CVE-2026-58472
GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Enco - CVE-2026-58470
GNU Wget 1.25.0 Integer Overflow via Content-Range Header Pa - CVE-2026-58469
GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsi - CVE-2024-10524
GNU Wget is vulnerable to an SSRF attack when accessing part - CVE-2018-0494
GNU Wget 输入验证漏洞
Same weakness: CWE-122
- CVE-2026-14940
389-ds-base: 389-ds-base: heap-buffer-overflow in dn normali - CVE-2026-11610
389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_re - CVE-2025-15668
GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overfl - CVE-2026-14759
radareorg radare2 RBinJava Line Number Table class.c r_bin_j - CVE-2026-14355
ext/openssl: Memory corruption in openssl_encrypt with AES-W
V. Comments for CVE-2026-58471
No comments yet