CVE-2026-58470 is an integer overflow vulnerability in GNU Wget through version 1.25.0. The issue exists in the parse_content_range() function within src/http.c, where server-controlled Content-Range header values can cause signed integer arithmetic overflow. This can result in undefined behavior and download desynchronization in the affected client. The vulnerability is addressed in commit 43d3ba9, though no official patch release version is specified in the provided data.

An attacker controlling a malicious server can exploit this vulnerability by sending specially crafted Content-Range headers to a vulnerable Wget client. This triggers integer overflow leading to undefined behavior and download desynchronization, which may disrupt normal operation of the client. There is no indication of privilege escalation or remote code execution from the provided data.

A fix for this vulnerability exists in the commit identified as 43d3ba9. Users should upgrade to a version of GNU Wget that includes this commit or later. Since no official patch release version is specified, users should monitor the vendor's advisory or source repository for the official patched release. Until then, avoid using vulnerable versions (<=1.25.0) when interacting with untrusted servers.