popt library CVE-2026-18839

Exploitation requires local system access with at least low-privilege credentials (PR:L per CVSS vector). The vulnerable code path is only reachable when an application triggers help text output - typically via a --help or -h flag. A specific environmental condition must also hold: the option table rendered for help display must exceed the current terminal width, which requires either a narrow terminal or an application with a very wide option layout. User interaction is required in the sense that a user (or attacker) must actively invoke the help output. What limits exploitation: the attack is purely local with no network vector, requires high complexity to reliably trigger the underflow, produces only application-level DoS with no privilege escalation, and has no confidentiality or integrity impact. Non-default or unusual terminal configurations increase trigger likelihood.

The overall risk is very low. The CVSS 3.1 base score of 2.2 with vector AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L reflects multiple stacked constraints: local access only, high attack complexity (specific terminal-width condition must be met), low-privilege authentication, and required user interaction (help output must be triggered). The scope is unchanged and the only impact is low availability - crashing the application. No EPSS data was provided in the intelligence sources, but given the complexity requirements and DoS-only impact, exploitation probability is expected to be very low. The vulnerability is not listed in CISA KEV, and no public proof-of-concept code has been identified. This is a genuine low-priority finding - not a case of high CVSS masking real risk, but consistently low across all signal dimensions. The primary realistic concern is denial of service for CLI utilities on shared Linux systems.

A local user with low privileges on a shared Linux system sets their terminal to a narrow width, then invokes a popt-linked CLI application with a help flag (e.g., --help), causing the help formatter to encounter an option table wider than the terminal. The integer underflow fires in the layout calculation, crashing the application. No public exploit code exists at time of analysis.