CVE-2026-58472 is a heap buffer overflow vulnerability in GNU Wget through version 1.25.0, specifically in the html_quote_string() function within src/convert.c. A remote attacker can supply a malicious HTML attribute containing a large number of characters requiring entity encoding, causing a signed integer counter to overflow during output size calculation. This results in an undersized heap allocation and a buffer overflow during the copy phase, potentially leading to memory corruption. The issue is resolved in a commit identified as dd692d9, which fixes the integer overflow and buffer allocation logic.

Successful exploitation can cause heap memory corruption in the affected Wget process. This may lead to application crashes or potentially allow an attacker to execute arbitrary code or cause denial of service. The vulnerability requires a crafted HTML attribute from a remote server and has a medium severity rating with a CVSS 4.0 score of 6.0. No known exploits are reported in the wild at this time.

A fix for this vulnerability is available in the commit dd692d9, which addresses the integer overflow and buffer allocation issues. Users should upgrade to a version of GNU Wget that includes this fix (versions later than 1.25.0). Since no official patch version number is provided, users should monitor the vendor's repository or official channels for the patched release. Until then, avoid using vulnerable versions to retrieve untrusted HTML content that may trigger this issue.