A stack-based buffer overflow vulnerability in GNU Wget2 (versions 2.1.0 through 2.2.0) poses a risk of memory corruption and application crashes when processing malicious URLs.

The vulnerability is a stack-based buffer overflow (CWE-121) located in the filename sanitization logic. An unauthenticated remote attacker can trigger this flaw by providing a specially crafted URL that the application processes while filename restriction options are enabled.

The exploitation of this vulnerability can lead to service disruption through application crashes, as well as potential arbitrary code execution via memory corruption. With a CVSS score of 7.6, this flaw is categorized as High severity. Organizations relying on Wget2 for automated file retrieval or system updates face potential system instability and unauthorized instruction execution if they process untrusted or malicious web content.

Immediate Action: Update GNU Wget2 to version 2.2.1 or later, as this release contains the necessary security fixes to resolve the buffer overflow.

Proactive Monitoring: Monitor system logs for unexpected crashes of the Wget2 process or irregular memory usage patterns during file download operations.

Compensating Controls: Restrict the use of Wget2 to trusted internal sources and implement network filtering to block connections to known malicious or suspicious URL structures that may be used to deliver exploit payloads.

Public Exploit Available: Unknown.

Given the High severity of this stack-based buffer overflow, administrators should prioritize updating their Wget2 installations to version 2.2.1 immediately. Failure to patch leaves systems vulnerable to memory corruption when interacting with untrusted web content. Verify the installed version using the command line and apply the update across all affected production environments to eliminate this risk.