CVE-2025-69195: 
NixOS vulnerability analysis and mitigation

CVE-2025-69195 is a stack-based buffer overflow vulnerability in GNU Wget2's filename sanitization logic, classified as CWE-121. It affects GNU Wget2 versions 2.1.0 through 2.2.0 (fixed in 2.2.1), as well as Microsoft Azure Linux 3 packages azl3_wget_2.1.0-6 and azl3_wget_2.1.0-7. The vulnerability was reported on December 29, 2025, and published to NVD on January 9, 2026. It carries a CVSS v3.1 base score of 8.8 (High) per NVD/NIST, and 7.6 (High) per the Fedora Project CNA (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability arises from missing bounds checks in Wget2's filename sanitization routine, which is triggered when filename restriction options such as --restrict-file-names=windows, unix, or ascii are active. During sanitization of attacker-controlled URL paths or HTTP redirect targets, the application writes beyond a fixed 1024-byte stack buffer, causing memory corruption (CWE-121) (Red Hat Bugzilla). The attack vector is network-based, requires no authentication or special privileges, but does require user interaction — specifically, a user must invoke wget2 against a malicious URL or be redirected to one. No public proof-of-concept exploit code has been identified at this time (Red Hat Advisory).

Successful exploitation can cause Wget2 to crash (denial of service) due to memory corruption from the stack buffer overflow. Beyond a crash, the memory corruption could potentially enable remote code execution or other malicious activities on the system running Wget2, with high impacts to confidentiality, integrity, and availability per the CVSS v3.1 assessment. The attack scope is limited to the affected host running Wget2, but a compromised system could serve as a foothold for further lateral movement (Red Hat Bugzilla, Red Hat Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the time of reporting. The EPSS score is approximately 0.078%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a user must run wget2 against a specially crafted URL — which somewhat limits opportunistic exploitation (Red Hat Advisory).

1. Set up a malicious server: Configure an HTTP server to serve responses with specially crafted URL paths or HTTP redirect headers containing excessively long or specially encoded filenames designed to overflow the 1024-byte stack buffer in Wget2's sanitization logic.
2. Lure the victim: Socially engineer a user into running wget2 with filename restriction options (e.g., --restrict-file-names=windows, unix, or ascii) against the attacker-controlled URL, or embed the malicious URL in a script or automated process that uses Wget2.
3. Trigger the overflow: When Wget2 processes the attacker-controlled URL path with filename restriction active, the sanitization routine writes beyond the fixed 1024-byte stack buffer due to missing bounds checks, causing memory corruption.
4. Achieve impact: Depending on the memory layout and exploitation sophistication, the result ranges from an application crash (denial of service) to potential arbitrary code execution on the victim's system (Red Hat Bugzilla).

• Process: Unexpected crashes or core dumps of the wget2 process, particularly when --restrict-file-names options are in use.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing segmentation faults or abnormal termination of wget2 processes.
• Network: Outbound wget2 connections to unfamiliar or suspicious hosts, especially if initiated by automated scripts or non-interactive sessions.
• File System: Presence of core dump files (e.g., core, core.wget2.*) in working directories where wget2 was executed.

The primary remediation is to upgrade GNU Wget2 to version 2.2.1 or later, which contains the fix for this vulnerability. For Microsoft Azure Linux 3, updated packages (azl3_wget) are available via the Microsoft Security Response Center. If immediate patching is not possible, avoid using Wget2 with --restrict-file-names options against untrusted or unknown URLs, and restrict user access to Wget2 functionality. Additionally, limit network access to only necessary destinations where Wget2 is deployed (Red Hat Advisory, Microsoft MSRC).

The vulnerability received coverage from security news outlets including SecurityOnline.info, which highlighted it alongside related Wget2 flaws involving arbitrary file overwrites. Linux distribution communities (Fedora, openSUSE, SUSE, Debian) responded with security update advisories and package updates. Social media accounts such as @TheHackerWire on Mastodon and Bluesky noted the vulnerability. German Linux security site pro-linux.de also covered the dual Wget2 issues. Overall community sentiment treated this as a significant but not immediately critical issue given the lack of known active exploitation (SecurityOnline).