GNU Wget versions up to 1.25.0 contain a heap buffer overflow in the convert_fname() function within src/url.c. When the iconv conversion reports an E2BIG error and a buffer reallocation is attempted, the computation of the remaining space is incorrect, allowing a maliciously crafted server‑supplied filename to overflow the output buffer. This is a CWE‑122 heap buffer overflow and results in memory corruption on the client side.

All installations of GNU Wget that have not applied commit c2640fe, including the widely distributed 1.25.0 release, are vulnerable. The issue affects any client execution that processes URLs whose filenames require character set conversion.

The CVSS score of 6 indicates moderate severity. An EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must control a server that supplies a specially crafted filename to trigger the overflow, constituting a remote attack vector. Successful exploitation would lead to memory corruption on the client machine.