CVE-2026-18739 affects the popt command-line option parsing library included in Red Hat Hardened Images. The vulnerability is an off-by-one error in the poptStuffArgs function that occurs when the function is called repeatedly or via deep alias nesting, leading to corruption of internal poptContext data. If a host application subsequently unsafely processes this corrupted data (e.g., passing it to exec, system, popen, or dlopen), it could allow local attackers to execute arbitrary code. The flaw has low impact due to the complexity of exploitation and specific conditions required. Red Hat has issued updated popt RPMs (version 1.19-11.1.hum1) for aarch64 and x86_64 architectures to fix this issue.

The vulnerability can cause corruption of internal program data, which may lead to denial of service or local code execution if the host application unsafely processes the corrupted data. The impact is rated low because exploitation requires repeated calls or deep alias nesting and unsafe handling by the host application. There are no known exploits in the wild.

Red Hat has released updated popt RPM packages (version 1.19-11.1.hum1) for affected architectures. Applying these updates will remediate the vulnerability. No other effective mitigations are available or meet Red Hat's criteria for ease of use and applicability. Users should apply the official Red Hat security update as detailed in the advisory at https://access.redhat.com/errata/RHSA-2026:56984.