An off-by-one error in the poptStuffArgs function of the popt library can cause out-of-bounds writes leading to corruption of internal program data. This occurs when the function is called repeatedly or via deep alias nesting. If a host application subsequently unsafely processes this corrupted poptContext data (e.g., passing it to exec, system, popen, or dlopen), a local attacker with low privileges could potentially execute arbitrary code. The vulnerability affects Red Hat Enterprise Linux 10, but no specific affected versions or patch availability are stated in the vendor advisory. The CVSS 3.1 base score is 2.5, reflecting low impact due to high attack complexity and local attack vector.

The vulnerability can cause internal data corruption in applications using the popt library, potentially leading to denial of service or local code execution if the corrupted data is unsafely handled by the host application. However, exploitation requires specific conditions: repeated calls or deep alias nesting triggering the off-by-one error, and unsafe processing of the corrupted data by the host application. The overall impact is rated low with no confidentiality or integrity impact, only availability impact (e.g., crashes). There are no known exploits in the wild.

Red Hat has not provided an explicit patch or official fix at this time. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18739 for current remediation guidance. Since exploitation depends on unsafe processing of corrupted data by host applications, review and harden any usage of popt in your environment to avoid unsafe handling of parsed data. Monitor Red Hat advisories for updates or patches addressing this issue.