Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
CVE-2025-69195 is fixed in wget2 on 1 platform, first by DEBIAN-CVE-2025-69195, released January 9, 2026. It is not reported as exploited. Patch Radar priority: High.
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| wget2 · Debian 13.5 (trixie) | 2.2.0+ds-1+deb13u1 | DEBIAN-CVE-2025-69195 | Jan 9, 2026 |
| wget2 · Debian 14 | 2.2.0+ds-3 | DEBIAN-CVE-2025-69195 | Jan 9, 2026 |
| wget2 · opensuse-leap 16.0 | 2.2.1-bp160.1.1 | OPENSUSE-SU-2026:20038-1 | Jan 14, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.