CVE-2026-18743: Incorrect Calculation of Buffer Size in rpm-software-management popt

This vulnerability arises from an error in how the poptConfigFileToString function reallocates memory buffers, leading to incorrect buffer size calculation. When specially crafted configuration content is loaded, this can cause a heap overflow resulting in heap metadata corruption. The impact is limited to denial of service due to process unavailability. The vulnerability affects popt versions 1.11 and later. Red Hat has published an advisory and released updated packages (popt-1.19-11.1.hum1) that fix this issue. The vulnerability has a CVSS 3.1 base score of 2.5, reflecting low impact with local attack vector, high attack complexity, and low privileges required.

The vulnerability can cause heap metadata corruption leading to denial of service by making the affected process unavailable. There is no impact on confidentiality or integrity. The attack requires local access with low privileges and high complexity, limiting the risk. Red Hat products are less exposed as the vulnerable function is not widely used internally, restricting the attack surface to scenarios where untrusted popt configuration content is explicitly loaded.

A security update fixing this vulnerability is available in popt version 1.19-11.1.hum1 and related packages. Users should apply this update to remediate the issue. Red Hat currently does not provide alternative mitigations that meet their criteria for ease of use and applicability. Since the vulnerability requires explicit loading of untrusted configuration content, avoiding such scenarios can reduce exposure. No other mitigations are recommended by Red Hat.