An integer underflow was identified in the popt library's help formatting function when handling option tables wider than the terminal width. This underflow can lead to memory allocation failures or out-of-bounds writes, causing the application to crash or fail to display help text properly. Exploitation requires a local user to trigger help output under narrow terminal conditions with large option widths, limiting the vulnerability's exploitability. The vulnerability is classified as CWE-191 (Integer Underflow) and results in a denial of service impact without confidentiality or integrity compromise. The CVSS v3.1 base score is 2.2, reflecting low impact with high attack complexity and local attack vector.

The vulnerability may cause affected applications to crash or fail to display help text, resulting in a denial of service condition. There is no impact on confidentiality or integrity. Exploitation requires local user access with low privileges and specific terminal conditions, limiting the risk and scope of impact.

No official fix or patch status is currently confirmed. Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18839 for current remediation guidance. Due to the high attack complexity and specific conditions required, no immediate mitigation actions are mandated by the vendor. Monitor the advisory for updates on patches or workarounds.