GNU Wget versions up to and including 1.25.0 contain a heap buffer underread flaw in the clean_metalink_string() function that processes Metalink URL lists. When a Metalink document includes a URL comprised only of whitespace characters, the function subtracts one from the pointer that references the buffer, allowing code to read past the buffer's start. This improper read can corrupt program memory or trigger abnormal termination, as the result of accessing memory outside the intended region. The weakness is classified as CWE‑125.

All installations that use the GNUget vendor, up to version 1.25.0, are impacted. Versions that incorporate commit 37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 or later are no longer vulnerable.

The CVSS score of 8.7 indicates a significant potential impact. The EPSS score, being below 1 %, suggests that exploitation is currently unlikely. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker can exploit the vulnerability remotely by hosting a malicious Metalink document containing a whitespace‑only URL; the victim’s Wget client merely needs to fetch the file over the network to trigger the bug. The combination of high severity and low exploitation probability points to a moderate overall risk for affected systems that regularly retrieve Metalink files.