GNU Wget versions up to 1.25.0 contain a heap buffer overflow in the convert_fname() function within src/url.c. When iconv reports an E2BIG error and reallocation occurs, the logic incorrectly calculates the available space, allowing a maliciously crafted server‑supplied filename to overflow the output buffer. The description notes memory corruption; it is classified as CWE‑122.

All builds of GNU Wget that have not incorporated commit c2640fe are affected, including the widely distributed 1.25.0 release. The vulnerability applies to client executions of wget that process URLs whose filenames require character set conversion. Systems running older wget binaries on any platform and lacking the patch are vulnerable.

The CVSS score of 6 indicates moderate. Less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must control a server that supplies a specially crafted filename to trigger the overflow, constituting a remote attack vector. Successful exploitation would cause memory corruption on the client machine, potentially leading to crashes or further attack steps if additional privileges are gained. The low current exploit probability, combined with the moderate severity, suggests that patching is the most effective mitigation.