CVE-2026-58471 is a heap buffer overflow vulnerability in GNU Wget through version 1.25.0, located in the convert_fname() function in src/url.c. The vulnerability arises when a server supplies a filename that requires character set conversion. During the iconv E2BIG reallocation process, if the output buffer is insufficiently sized, the reallocation logic incorrectly calculates the remaining buffer space, causing a heap overflow. This memory corruption could potentially be triggered remotely by a malicious server response. The vulnerability was addressed in commit c2640fe, which fixes the buffer reallocation logic.

Successful exploitation can lead to heap memory corruption in the wget process, which may cause crashes or potentially enable further attacks depending on the context. The vulnerability requires a malicious server response with a crafted filename that triggers the flawed character set conversion logic. The CVSS 4.0 vector indicates the attack requires network access with high attack complexity and user interaction, and it has a high impact on availability and low impact on integrity and confidentiality.

A fix for this vulnerability is available in the GNU Wget source code as of commit c2640fe. Users and administrators should upgrade to a version of wget that includes this fix, i.e., any version later than 1.25.0. Since this is not a cloud service, remediation depends on applying the updated software. Patch status is not explicitly stated in the provided data, but the commit reference indicates an official fix exists. Until patched, avoid using wget to retrieve files from untrusted servers that might supply malicious filenames requiring character set conversion.