Memory Corruption Vulnerability in Popt Affects Red Hat
CVE-2026-18743

2.5LOW

Key Information:

Vendor

Rpm-software-management

Status
Popt
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Vendor
CVE Published:
1 September 2026

What is CVE-2026-18743?

A flaw exists in Popt that enables attackers to introduce specially crafted configuration content. When this content is loaded, it can trigger a memory corruption issue due to an error in the reallocation of buffers by the poptConfigFileToString function. Exploiting this vulnerability could lead to heap metadata corruption, which may render the affected process unavailable, resulting in denial of service.

Affected Version(s)

popt 1.11

References

https://access.redhat.com/security/cve/CVE-2026-18743
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2510809
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
2.5
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Matanya Moses (Checkpoint) for reporting this issue.
.