Vulnerability record · CVE-2026-58469 · published 7 July 2026

CVE-2026-58469: Gnu wget out-of-bounds read vulnerability

Gnu · Wget

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.

8.7 CVSS 4.0 High EPSS 0.49% · top 60.1% CWE-125 · Out-of-bounds read

8.7CVSS 4.0 base score

0.49%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

9 Jul 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Wget Gnu

References

Link	Tags
https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826	Patch
https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-underread-via-metalink-url-parsing	PatchThird Party Advisory

Track CVE-2026-58469 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-5953Gnu wget out-of-bounds write vulnerabilityBuffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspec…EPSS 5.9%17 May 2019 9.3CVE-2014-4877Gnu wget path traversal vulnerabilityAbsolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and …EPSS 40%29 Oct 2014 9.1CVE-2024-38428Gnu wget interpretation conflict vulnerabilityurl.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data t…EPSS 0.67%16 Jun 2024 8.8CVE-2017-13089GNU Wget chunked transfer parser stack buffer overflowWget before 1.19.2 fails to validate that a chunk length in a chunked HTTP response is non-negative. A negative length is passed through MIN() to fd_…EPSS 80%analysed27 Oct 2017 8.8CVE-2017-13090Gnu wget heap-based buffer overflow vulnerabilityThe retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser …EPSS 37%27 Oct 2017 8.8CVE-2016-4971GNU wget HTTP-to-FTP redirect arbitrary file writeGNU wget before 1.18 follows a server-supplied redirect from HTTP to a crafted FTP resource and writes the retrieved content to an attacker-chosen pa…EPSS 46%analysed30 Jun 2016 8.1CVE-2016-7098Gnu wget race condition vulnerabilityRace condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass int…EPSS 7.5%26 Sep 2016 7.8CVE-2018-20483Gnu wget information exposure vulnerabilityset_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attri…EPSS 0.66%26 Dec 2018

Source: NIST National Vulnerability Database (record CVE-2026-58469), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.