CVE-2017-13090

CVE-2017-13090 is a critical vulnerability affecting GNU Wget versions prior to 1.19.2, specifically within the retr.c:fd_read_body() function when processing chunked OK responses. An attacker can manipulate a negative chunk length, leading to an attacker-controlled length argument in fd_read(), which can corrupt malloc metadata. This vulnerability carries a high CVSS score of 8.8, indicating a severe impact with high confidentiality, integrity, and availability risks, and can be exploited remotely with low complexity, requiring user interaction. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion.