CVE-2026-18839: Popt-devel: popt-static: size_t underflow in singleoptionhelp

Severity: low (CVSS 2.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-05 · updated 2026-10-08
Weakness: CWE-191

Description

An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions
Red Hat Hardened Images: all versions — fixed in 1.19-11.2.hum1
rpm-software-management popt: from 1.13

How to fix

Upgrade to a fixed version: Red Hat Hardened Images 1.19-11.2.hum1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18839 or the next vulnerability affects your stack