GNU Wget versions up to and including 1.25.0 contain a heap buffer underread flaw in the clean_metalink_string() function that processes Metalink URL lists. When a Metalink document includes a URL composed solely of whitespace characters, the function subtracts one from the pointer that references the buffer, allowing code to read past the buffer's start. This improper read can lead to abnormal program behavior, as described in the advisory. The weakness is classified as CWE‑125.

All installations that use the GNU Wget product, up to version 1.25.0, are impacted. Versions that incorporate commit 37a40fc or later are no longer vulnerable.

The CVSS score of 8.7 indicates a significant potential impact. The EPSS score, being below 1 %, suggests that exploitation is currently unlikely. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker can exploit the vulnerability remotely by hosting a malicious Metalink document containing a whitespace‑only URL; the victim’s Wget client merely needs to fetch the file over the network to trigger the bug. The combination of high severity and low exploitation probability points to a moderate overall risk for affected systems that regularly retrieve Metalink files.