A heap buffer overflow exists in the html_quote_string() function of GNU Wget 1.25.0 and earlier when processing a large HTML attribute that requires extensive entity encoding. The signed integer counter used to accumulate the expected output size overflows, leading to an undersized heap allocation. When the copy operation subsequently occurs, memory adjacent to the buffer can be overwritten, allowing an attacker to corrupt data in memory. The vulnerability is a classic signed integer overflow (CWE-190). If exploited, it could enable an attacker to alter program control flows or other sensitive data structures, potentially resulting in remote code execution or privilege escalation.

The flaw affects all installations of GNU Wget up through version 1.25.0. It is present on any platform that compiles and runs the legacy html_quote_string() routine. The patch is applied in commit dd692d9 and is available in newer releases of wget.

The CVSS base score of 6 indicates moderate severity. The EPSS score of < 1% reflects a very low, but not zero, likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. A remote attacker can exploit the flaw by providing a specially crafted HTML attribute to a server that then invokes wget, causing the overflow. The attack requires no local privileges and does not depend on user interaction, making it a true remote vector.