EUVD-2026-52577
GHSA-255r-gqmx-m2jm
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
AV:L/AC:H/PR:L confirmed from vendor CVSS; C/I/A:H reflects the described worst-case RCE outcome despite vendor's conservative C:N/I:N/A:L scoring.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
AnalysisAI
Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.
Technical ContextAI
popt is a C library for parsing command-line options, packaged as a core system component in RPM-based Linux distributions including all RHEL variants. The vulnerable function poptStuffArgs manages a dynamically-sized internal argument array; a classic off-by-one error (CWE-787: Out-of-bounds Write) allows a write operation to land one position beyond the allocated buffer boundary, corrupting adjacent heap or stack memory. This class of bug can overwrite internal control structures, function pointers, or data used by the calling application. The flaw activates under two triggering paths: a host application making repeated programmatic calls to poptStuffArgs, or deeply nested command-line alias definitions that recursively re-enter the function. Affected CPEs span cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through red_hat_enterprise_linux_10, red_hat_hardened_images, and red_hat_openshift_container_platform_4, indicating the vulnerability is present across Red Hat's entire supported product surface for this library.
RemediationAI
The primary remediation is to apply the Red Hat-issued popt package update for the applicable RHEL version when released; monitor the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18739 and Bugzilla entry 2510737 at https://bugzilla.redhat.com/show_bug.cgi?id=2510737 for confirmed patched version numbers, which were not available in the data at time of analysis. As a compensating control pending patch availability, restrict local interactive shell access to affected systems to the minimum required set of users, reducing the pool of potential attackers who could trigger the repeated-call or deep-alias invocation pattern; note this does not protect against exploitation via setuid binaries or daemons that invoke popt on behalf of lower-privileged users. Application developers embedding popt should audit any code path following poptStuffArgs calls to ensure argument data is validated before further processing, which addresses the chained condition required for RCE but is not a substitute for patching the library itself.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today