popt CVE-2026-18743

Exploitation requires a local shell account with at least low privileges on the affected host (AV:L, PR:L from CVSS vector). The attacker must be able to write or otherwise control a popt configuration file at a path that a target process will load via poptConfigFileToString - for example, a per-user ~/.popt file affecting processes running under that user's context, or a system-wide configuration file if the attacker has elevated write access. High attack complexity (AC:H) reflects that the crafted configuration content must precisely trigger the incorrect buffer size calculation during realloc; a generic malformed file is unlikely to cause the corruption reliably. Exploitation is strictly bounded to process availability - no data exfiltration or code execution path is indicated. On SELinux-enforcing RHEL systems, mandatory access control further restricts which accounts may write to configuration paths consumed by confined services, raising the effective exploitation bar beyond the baseline CVSS assessment.

The overall risk is low. CVSS 2.5 is driven by AV:L (attacker must be local), AC:H (the crafted configuration must precisely satisfy heap allocation conditions), PR:L (a non-privileged local account is required), and A:L (impact is limited to a process crash). There is no confidentiality or integrity impact. EPSS data was not provided in the input, preventing probabilistic exploitation likelihood comparison. The CVE is absent from CISA KEV and no public proof-of-concept is identified, so no public weaponization is confirmed. While heap metadata corruption theoretically offers a springboard toward more severe primitives, the description and scoring explicitly bound the realistic impact to denial of service. On hardened RHEL deployments, SELinux mandatory access control policies restrict configuration file write access, further raising the exploitation bar. This vulnerability is unlikely to meet emergency patching thresholds in most environments and fits standard patch management cadence.

A local attacker with a low-privileged shell account writes a precisely sized malicious popt configuration file to a location (such as ~/.popt) that will be read by a higher-value process invoking poptConfigFileToString. When the target process loads this configuration, the incorrect realloc size calculation corrupts adjacent heap metadata, causing the process to crash and become unavailable. No public proof-of-concept is known, and the high attack complexity indicates the crafted content must meet specific sizing thresholds to trigger the corruption reliably.