CVE-2026-18739: Popt-devel: popt-static: off-by-one in poptstuffargs
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
Other sources
Depth check lacks + 1 vs handleAlias; 10th stuff can advance os past optionStack[0..9] into adjacent poptContext fields (e.g. leftovers). Claimed LCE only if host uses corrupted poptGetArg unsafely.
popt-1.18/src/popt.c:1671
Flow: Host repeatedly calls poptStuffArgs (and/or deep alias nesting) → overflow con->os → corrupt context → later poptGetArg / poptGetArgs / poptPeekArg → only if host sinks that string into exec/system/popen/dlopen (or equivalent).
Analysis has identified that this goes back to the git tag popt-111
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
poptto a version that resolves this vulnerability.Fixed in popt-1_1_1