Vulnerability Report - 4 findings in GNU Wget 1.25.0

--000000000000cdcfb506552f52dd
Content-Type: text/plain; charset="UTF-8"

Hello,

I am writing to report 4 memory safety vulnerabilities in GNU Wget
1.25.0, all confirmed present at master HEAD on GNU Savannah (2026-06-20).
These cover the Metalink URL parser, HTTP Content-Range header handling,
iconv filename conversion, and HTML link conversion.

Summary of findings:

1. Heap buffer underread in clean_metalink_string() -- crash (CVSS 7.5)
2. Signed integer overflow in parse_content_range() -- UB/desync (CVSS 5.3)
3. Heap buffer overflow in convert_fname() iconv E2BIG handler (CVSS 6.1)
4. Integer overflow in html_quote_string() size counter (CVSS 5.9)

Findings #1 and #2 are triggered by a malicious server without user
interaction beyond initiating the download. Finding #3 requires
--remote-encoding or IRI mode. Finding #4 requires recursive download
with --convert-links and a very large HTML attribute.

All 4 have been lab-verified with AddressSanitizer and/or
UndefinedBehaviorSanitizer. Individual details are attached.

I would appreciate an acknowledgment of receipt and CVE assignment for
each confirmed finding.

Thank you and please let me know if you need anything else.

Regards,
Tristan

--000000000000cdcfb506552f52dd
Content-Type: text/plain; charset="US-ASCII"; name="vuln-3-iconv-heap-overflow.txt"
Content-Disposition: attachment; filename="vuln-3-iconv-heap-overflow.txt"
Content-Transfer-Encoding: base64
Content-ID: <f_mqvhbok42>
X-Attachment-Id: f_mqvhbok42

R05VIFdnZXQgMS4yNS4wIC0tIEhlYXAgQnVmZmVyIE92ZXJmbG93IGluIGNvbnZlcnRfZm5hbWUo
KSBpY29udiBFMkJJRyBIYW5kbGVyCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09CkNWU1MgMy4xOiA2
LjEgKEFWOk4vQUM6SC9QUjpOL1VJOlIvUzpVL0M6Ti9JOkwvQTpIKQpDV0U6IENXRS0xMjIgKEhl
YXAtYmFzZWQgQnVmZmVyIE92ZXJmbG93KQpBdXRoOiBOb25lIChyZXF1aXJlcyAtLXJlbW90ZS1l
bmNvZGluZyBvciBJUkkgd2l0aCBub24tVVRGLTggY29udGVudCkKVmVyc2lvbjogMS4yNS4wLCBt
YXN0ZXIgSEVBRCAoMjAyNi0wNi0yMCkKCkZpbGU6IHNyYy91cmwuYywgY29udmVydF9mbmFtZSgp
LCBsaW5lcyAxNjI0LTE2NjMKClJvb3QgQ2F1c2U6ClRoZSBFMkJJRyBlcnJvciBoYW5kbGVyIGlu
Y29ycmVjdGx5IGNhbGN1bGF0ZXMgYXZhaWxhYmxlIG91dHB1dCBzcGFjZSBhZnRlcgpyZWFsbG9j
YXRpb24uIEl0IHNldHMgb3V0bGVuIHRvIHRoZSB0b3RhbCBuZXcgYnVmZmVyIHNpemUgaW5zdGVh
ZCBvZiB0aGUKcmVtYWluaW5nIHNwYWNlIGZyb20gdGhlIHdyaXRlIHBvaW50ZXIuIFRoaXMgdGVs
bHMgaWNvbnYgdGhhdCBgZG9uZWAgbW9yZQpieXRlcyBhcmUgYXZhaWxhYmxlIHRoYW4gYWN0dWFs
bHkgZXhpc3QuCgogIGVsc2UgaWYgKGVycm5vID09IEUyQklHKQogICAgewogICAgICBkb25lID0g
bGVuOyAgICAgICAgICAgICAgICAgICAgICAgICAgIC8vIG9sZCB0b3RhbCBidWZmZXIgc2l6ZQog
ICAgICBsZW4gPSBvdXRsZW4gPSBkb25lICsgaW5sZW4gKiAyOyAgICAgIC8vIEJVRzogb3V0bGVu
ID0gdG90YWwsIG5vdCByZW1haW5pbmcKICAgICAgY29udmVydGVkX2ZuYW1lID0geHJlYWxsb2Mo
Y29udmVydGVkX2ZuYW1lLCBvdXRsZW4gKyAxKTsKICAgICAgcyA9IGNvbnZlcnRlZF9mbmFtZSAr
IGRvbmU7ICAgICAgICAgICAvLyB3cml0ZSBwb2ludGVyIGF0IG9sZCBlbmQKICAgIH0KCkFmdGVy
IHRoaXM6IGFjdHVhbCBzcGFjZSBmcm9tIHMgdG8gYnVmZmVyIGVuZCA9IGlubGVuKjIgYnl0ZXMu
CkJ1dCBvdXRsZW4gY2xhaW1zOiBkb25lICsgaW5sZW4qMiBieXRlcy4gT3ZlcmNsYWltID0gZG9u
ZSBieXRlcy4KaWNvbnYgd3JpdGVzIHBhc3QgdGhlIGJ1ZmZlciBieSB1cCB0byBgZG9uZWAgYnl0
ZXMuCgpEYXRhIEZsb3c6CiAgU2VydmVyIHByb3ZpZGVzIFVSTCB3aXRoIGNoYXJhY3RlcnMgZXhw
YW5kaW5nID4yeCB1bmRlciBpY29udgogIChlLmcuLCBJU08tODg1OS0xIHRvIFdDSEFSX1Q6IDEg
Ynl0ZSAtPiA0IGJ5dGVzKQogIC0+IGNvbnZlcnRfZm5hbWUoKSBpbml0aWFsIGJ1ZmZlciAoaW5s
ZW4qMikgaW5zdWZmaWNpZW50CiAgLT4gaWNvbnYgcmV0dXJucyBFMkJJRwogIC0+IEJ1Z2d5IHJl
YWxsb2M6IG91dGxlbiBvdmVyY2xhaW1zIGJ5IGBkb25lYCBieXRlcwogIC0+IE5leHQgaWNvbnYg
d3JpdGVzIHBhc3QgYnVmZmVyIGVuZAoKTGFiIFZlcmlmaWNhdGlvbjoKQWRkcmVzc1Nhbml0aXpl
cjogaGVhcC1idWZmZXItb3ZlcmZsb3cgV1JJVEUgb2Ygc2l6ZSAyMCBhdCAwIGJ5dGVzIGFmdGVy
CjMxLWJ5dGUgcmVnaW9uLiBUcmlnZ2VyZWQgd2l0aCBJU08tODg1OS0xIHRvIFdDSEFSX1QgY29u
dmVyc2lvbiAoNHgKZXhwYW5zaW9uIHJhdGlvIGZvcmNlcyBFMkJJRyBvbiBzbWFsbCBpbnB1dCku
Cg==
--000000000000cdcfb506552f52dd
Content-Type: text/plain; charset="US-ASCII"; name="vuln-4-html-quote-overflow.txt"
Content-Disposition: attachment; filename="vuln-4-html-quote-overflow.txt"
Content-Transfer-Encoding: base64
Content-ID: <f_mqvhbola3>
X-Attachment-Id: f_mqvhbola3

R05VIFdnZXQgMS4yNS4wIC0tIEludGVnZXIgT3ZlcmZsb3cgaW4gaHRtbF9xdW90ZV9zdHJpbmco
KSBMZWFkaW5nIHRvIEhlYXAgT3ZlcmZsb3cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K
Q1ZTUyAzLjE6IDUuOSAoQVY6Ti9BQzpIL1BSOk4vVUk6Ui9TOlUvQzpOL0k6TC9BOkgpCkNXRTog
Q1dFLTE5MCAoSW50ZWdlciBPdmVyZmxvdykgbGVhZGluZyB0byBDV0UtMTIyIChIZWFwIEJ1ZmZl
ciBPdmVyZmxvdykKQXV0aDogTm9uZSAocmVxdWlyZXMgcmVjdXJzaXZlIGRvd25sb2FkIHdpdGgg
LS1jb252ZXJ0LWxpbmtzKQpWZXJzaW9uOiAxLjI1LjAsIG1hc3RlciBIRUFEICgyMDI2LTA2LTIw
KQoKRmlsZTogc3JjL2NvbnZlcnQuYywgaHRtbF9xdW90ZV9zdHJpbmcoKSwgbGluZXMgMTE3Ny0x
MjM1CgpSb290IENhdXNlOgpUaGUgb3V0cHV0IGJ1ZmZlciBzaXplIGNvdW50ZXIgaXMgZGVjbGFy
ZWQgYXMgYGludGAgKDMyLWJpdCBzaWduZWQpLiBFYWNoCnNwZWNpYWwgY2hhcmFjdGVyIGFkZHMg
NC02IHRvIHRoZSBjb3VudGVyLiBXaXRoIH4zNTggbWlsbGlvbiBzcGVjaWFsCmNoYXJhY3RlcnMg
KGUuZy4sIGAiYCBhZGRzIDYgZWFjaCksIHRoZSBjb3VudGVyIG92ZXJmbG93cyBJTlRfTUFYLCB3
cmFwcGluZwp0byBhIHNtYWxsIG9yIG5lZ2F0aXZlIHZhbHVlLiB4bWFsbG9jIHRoZW4gYWxsb2Nh
dGVzIGEgdGlueSBidWZmZXIsIGFuZCB0aGUKZXhwYW5zaW9uIGxvb3Agd3JpdGVzIHRoZSBmdWxs
IG91dHB1dCBwYXN0IGl0LgoKICBpbnQgaTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IC8vIDMyLWJpdCBzaWduZWQgY291bnRlcgogIGZvciAoaSA9IDA7ICpzOyBzKyssIGkrKykgewog
ICAgaWYgKCpzID09ICcmJykgIGkgKz0gNDsgICAgICAgICAgICAgLy8gNSB0b3RhbCBwZXIgJyYn
CiAgICBlbHNlIGlmICgqcyA9PSAnIicpIGkgKz0gNTsgICAgICAgICAvLyA2IHRvdGFsIHBlciAn
IicKICAgIGVsc2UgaWYgKCpzID09ICcgJykgaSArPSA0OyAgICAgICAgIC8vIDUgdG90YWwgcGVy
ICcgJwogICAgLi4uCiAgfQogIHJlcyA9IHhtYWxsb2MoaSArIDEpOyAgICAgICAgICAgICAgICAv
LyB1bmRlcnNpemVkIGFmdGVyIG92ZXJmbG93CgpEYXRhIEZsb3c6CiAgTWFsaWNpb3VzIHNlcnZl
ciByZXR1cm5zIEhUTUwgd2l0aCB+MzU4TUIgVVJMIGF0dHJpYnV0ZSBmaWxsZWQgd2l0aCAnIicK
ICAtPiB3Z2V0IGRvd25sb2FkcyBpbiByZWN1cnNpdmUgbW9kZSAoLXIpCiAgLT4gLS1jb252ZXJ0
LWxpbmtzIHRyaWdnZXJzIGh0bWxfcXVvdGVfc3RyaW5nKCkgb24gVVJMcyBub3QgZG93bmxvYWRl
ZAogIC0+IGludCBjb3VudGVyIHdyYXBzOiAzNTcsOTEzLDk0MiAqIDYgPSAyLDE0Nyw0ODMsNjUy
IC0+IC0yLDE0Nyw0ODMsNjQ0CiAgLT4geG1hbGxvYygtMiwxNDcsNDgzLDY0MykgaW50ZXJwcmV0
cyBhcyBodWdlIHNpemVfdCAtPiB4YWxsb2NfZGllIGNyYXNoCiAgLT4gT1Igb24gMzItYml0OiBh
bGxvY2F0ZXMgdGlueSBidWZmZXIgLT4gfjJHQiBoZWFwIG92ZXJmbG93CgpMYWIgVmVyaWZpY2F0
aW9uOgpBcml0aG1ldGljIGNvbmZpcm1lZDogMzU3LDkxMyw5NDIgJyInIGNoYXJzIHByb2R1Y2Ug
dHJ1ZSBjb3VudCAyLDE0Nyw0ODMsNjUyLAp3aGljaCB3cmFwcyB0byAtMiwxNDcsNDgzLDY0NCBh
cyBpbnQuIEV4cGFuc2lvbiB3b3VsZCB3cml0ZSAyLjE1R0IgaW50byBhCnRpbnkgYWxsb2NhdGlv
bi4K
--000000000000cdcfb506552f52dd
Content-Type: text/plain; charset="US-ASCII"; name="vuln-2-content-range-overflow.txt"
Content-Disposition: attachment; 
	filename="vuln-2-content-range-overflow.txt"
Content-Transfer-Encoding: base64
Content-ID: <f_mqvhboit1>
X-Attachment-Id: f_mqvhboit1

R05VIFdnZXQgMS4yNS4wIC0tIFNpZ25lZCBJbnRlZ2VyIE92ZXJmbG93IGluIHBhcnNlX2NvbnRl
bnRfcmFuZ2UoKQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT0KQ1ZTUyAzLjE6IDUuMyAoQVY6Ti9BQzpML1BSOk4vVUk6
Ti9TOlUvQzpOL0k6Ti9BOkwpCkNXRTogQ1dFLTE5MCAoSW50ZWdlciBPdmVyZmxvdyBvciBXcmFw
YXJvdW5kKQpBdXRoOiBOb25lIChtYWxpY2lvdXMgc2VydmVyIHJlc3BvbnNlKQpWZXJzaW9uOiAx
LjI1LjAsIG1hc3RlciBIRUFEICgyMDI2LTA2LTIwKQoKRmlsZTogc3JjL2h0dHAuYywgcGFyc2Vf
Y29udGVudF9yYW5nZSgpLCBsaW5lcyA5MTMtOTYwCgpSb290IENhdXNlOgpNYW51YWwgZGlnaXQt
YnktZGlnaXQgYWNjdW11bGF0aW9uIG9mIENvbnRlbnQtUmFuZ2UgaGVhZGVyIHZhbHVlcyBoYXMg
bm8Kb3ZlcmZsb3cgY2hlY2suIFNpbmNlIGBudW1gIGlzIHdnaW50IChpbnQ2NF90KSwgdmFsdWVz
IGV4Y2VlZGluZyBJTlQ2NF9NQVgKY2F1c2Ugc2lnbmVkIGludGVnZXIgb3ZlcmZsb3cgKHVuZGVm
aW5lZCBiZWhhdmlvcikuIENvbXBhcmUgd2l0aApDb250ZW50LUxlbmd0aCBwYXJzaW5nIHdoaWNo
IHByb3Blcmx5IHVzZXMgc3RyX3RvX3dnaW50L3N0cnRvbGwgKyBFUkFOR0UuCgogIGZvciAobnVt
ID0gMDsgY19pc2RpZ2l0KCpoZHIpOyBoZHIrKykKICAgIG51bSA9IDEwICogbnVtICsgKCpoZHIg
LSAnMCcpOyAgICAvLyBubyBvdmVyZmxvdyBjaGVjawoKRGF0YSBGbG93OgogIE1hbGljaW91cyBz
ZXJ2ZXIgc2VuZHM6IENvbnRlbnQtUmFuZ2U6IGJ5dGVzIDkyMjMzNzIwMzY4NTQ3NzU4MTAtLi4u
CiAgLT4gcGFyc2VfY29udGVudF9yYW5nZSgpIG92ZXJmbG93cyBpbnQ2NF90CiAgLT4gY29udGxl
biA9IGxhc3RfYnl0ZSAtIGZpcnN0X2J5dGUgKyAxIHByb2R1Y2VzIGFyYml0cmFyeSBpbnQ2NAog
IC0+IGZkX3JlYWRfYm9keSB1c2VzIGNvcnJ1cHRlZCBjb250bGVuIGZvciBkb3dubG9hZCBzaXpl
CiAgLT4gT24ga2VlcC1hbGl2ZTogaW5jb3JyZWN0IGNvbnRlbnQgZHJhaW5pbmcgLT4gcHJvdG9j
b2wgZGVzeW5jCgpMYWIgVmVyaWZpY2F0aW9uOgpVQlNhbjogInNpZ25lZCBpbnRlZ2VyIG92ZXJm
bG93OiA5OTk5OTk5OTk5OTk5OTk5OTkgKiAxMCBjYW5ub3QgYmUKcmVwcmVzZW50ZWQgaW4gdHlw
ZSAnbG9uZyBpbnQnIiAoMyBpbnN0YW5jZXMpLiBSZXN1bHRpbmcgZmlyc3RfYnl0ZQpiZWNvbWVz
IC05MjIzMzcyMDM2ODU0Nzc1ODA2Lgo=
--000000000000cdcfb506552f52dd
Content-Type: text/plain; charset="US-ASCII"; name="vuln-1-metalink-underread.txt"
Content-Disposition: attachment; filename="vuln-1-metalink-underread.txt"
Content-Transfer-Encoding: base64
Content-ID: <f_mqvhbogy0>
X-Attachment-Id: f_mqvhbogy0

R05VIFdnZXQgMS4yNS4wIC0tIEhlYXAgQnVmZmVyIFVuZGVycmVhZCBpbiBjbGVhbl9tZXRhbGlu
a19zdHJpbmcoKQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT0KQ1ZTUyAzLjE6IDcuNSAoQVY6Ti9BQzpML1BSOk4vVUk6
Ti9TOlUvQzpOL0k6Ti9BOkgpCkNXRTogQ1dFLTEyNSAoT3V0LW9mLWJvdW5kcyBSZWFkKQpBdXRo
OiBOb25lIChtYWxpY2lvdXMgc2VydmVyIHJlc3BvbnNlKQpWZXJzaW9uOiAxLjI1LjAsIG1hc3Rl
ciBIRUFEICgyMDI2LTA2LTIwKQoKRmlsZTogc3JjL21ldGFsaW5rLmMsIGNsZWFuX21ldGFsaW5r
X3N0cmluZygpLCBsaW5lcyAxMDQwLTEwNzMKClJvb3QgQ2F1c2U6ClRoZSBiYWNrd2FyZC1zY2Fu
bmluZyBsb29wIHRoYXQgc3RyaXBzIHRyYWlsaW5nIHdoaXRlc3BhY2UgaGFzIG5vIGxvd2VyCmJv
dW5kIGNoZWNrLiBXaGVuIHRoZSBpbnB1dCBzdHJpbmcgY29uc2lzdHMgZW50aXJlbHkgb2Ygd2hp
dGVzcGFjZSwgdGhlCmZvcndhcmQgc2NhbiBhZHZhbmNlcyBgYmVnYCBwYXN0IGFsbCBjb250ZW50
IHRvIHRoZSBOVUwgdGVybWluYXRvciwgdGhlbgp0aGUgYmFja3dhcmQgc2NhbiByZWFkcyBieXRl
cyBiZWZvcmUgYGJlZ2AgKGJlZm9yZSB0aGUgaGVhcCBhbGxvY2F0aW9uKS4KCiAgYmVnID0gKnN0
cjsKICB3aGlsZSAoKGMgPSAqYmVnKSAmJiAoYyA9PSAnXG4nIHx8IGMgPT0gJ1xyJyB8fCBjID09
ICdcdCcgfHwgYyA9PSAnICcpKQogICAgYmVnKys7ICAgICAgICAgICAgICAgICAgICAgICAvLyBh
bGwgd2hpdGVzcGFjZTogYmVnIHBvaW50cyB0byBOVUwKCiAgZW5kID0gYmVnOwogIHdoaWxlICgo
YyA9ICplbmQpICYmIChjICE9ICdccicpICYmIChjICE9ICdcbicpKQogICAgZW5kKys7ICAgICAg
ICAgICAgICAgICAgICAgICAvLyBleGl0cyBpbW1lZGlhdGVseSAoTlVMKQoKICBpZiAoKmVuZCA9
PSAnXDAnKQogICAgd2hpbGUgKChjID0gKihlbmQgLSAxKSkgJiYgKGMgPT0gJ1xuJyB8fCBjID09
ICdccicgfHwgYyA9PSAnXHQnIHx8IGMgPT0gJyAnKSkKICAgICAgZW5kLS07ICAgICAgICAgICAg
ICAgICAgICAgLy8gQlVHOiBubyBsb3dlciBib3VuZCwgcmVhZHMgYmVmb3JlIGFsbG9jYXRpb24K
CiAgbGVuID0gZW5kIC0gYmVnOyAgICAgICAgICAgICAgIC8vIHdyYXBzIHRvIGh1Z2Ugc2l6ZV90
IChiZWcgPiBlbmQpCiAgbmV3ID0geG1lbWR1cDAoYmVnLCBsZW4pOyAgICAgIC8vIHhhbGxvY19k
aWUoKSBvciBtYXNzaXZlIG1lbWNweQoKRGF0YSBGbG93OgogIE1hbGljaW91cyBzZXJ2ZXIgc2Vy
dmVzIE1ldGFsaW5rIFhNTCB3aXRoIGFsbC13aGl0ZXNwYWNlIDx1cmw+ICAgPC91cmw+CiAgLT4g
cmV0cmlldmVfZnJvbV9tZXRhbGluaygpIGNhbGxzIGNsZWFuX21ldGFsaW5rX3N0cmluZygmbXJl
cy0+dXJsKQogIC0+IGJhY2t3YXJkIHNjYW4gcmVhZHMgYmVmb3JlIGhlYXAgYnVmZmVyCiAgLT4g
d3JhcHBlZCBsZW4gY2F1c2VzIHhhbGxvY19kaWUoKSAoY3Jhc2gpCgpMYWIgVmVyaWZpY2F0aW9u
OgpBZGRyZXNzU2FuaXRpemVyOiBoZWFwLWJ1ZmZlci1vdmVyZmxvdyBSRUFEIG9mIHNpemUgMSwg
MSBieXRlIGJlZm9yZQo0LWJ5dGUgcmVnaW9uLiBDb25maXJtZWQgY3Jhc2ggb24gc3RyZHVwKCIg
ICAiKSBpbnB1dC4K
--000000000000cdcfb506552f52dd--