CVE-2026-18743
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary
A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the poptConfigFileToString function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| rpm-software-management | popt | 1.11 < * | affected |
Weaknesses
- CWE-131: Incorrect Calculation of Buffer Size
Workarounds
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References
- https://access.redhat.com/security/cve/CVE-2026-18743
- https://bugzilla.redhat.com/show_bug.cgi?id=2510809
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.