CVE-2026-58469 is a heap buffer underread vulnerability in GNU Wget through version 1.25.0, specifically in the clean_metalink_string() function within src/metalink.c. When Wget processes a Metalink document containing a URL composed entirely of whitespace, the function decrements a pointer past the start of the buffer, leading to memory corruption and abnormal program behavior. This vulnerability allows a malicious server to trigger this condition by serving a crafted Metalink document. The issue was fixed in a commit identified as 37a40fc, which is after version 1.25.0.

A remote attacker can cause memory corruption in Wget by serving a Metalink document with a whitespace-only URL. This can lead to abnormal program behavior, potentially causing crashes or other unintended effects. The vulnerability does not require any privileges or user interaction to exploit, making it remotely exploitable over the network. There are no known exploits in the wild at this time.

A fix for this vulnerability exists in the commit 37a40fc, which is after version 1.25.0. Users should upgrade to a version of GNU Wget that includes this fix. Since the vulnerability is in a client application, updating to a patched version is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; therefore, verify the vendor advisory or official source for the exact fixed version and apply the update accordingly.