popt EUVD-2026-52577

Exploitation requires local system access with at least low-privilege credentials (AV:L/PR:L per CVSS vector). High attack complexity (AC:H) is confirmed: the off-by-one must be triggered through either repeated programmatic invocations of poptStuffArgs by the host application or through deeply nested command-line alias definitions - neither condition occurs in standard, single-invocation argument parsing. A second chained condition is also required: the host application must subsequently process the corrupted internal argument data in an unsafe manner; the library corruption alone is insufficient for code execution and is scored only A:L absent this condition. Limiting factors include: strictly local attack vector (no network-based exploitation path exists); non-default triggering conditions precluding casual exploitation; CVSS Scope:Unchanged meaning impact is contained to the affected application process; and the requirement for attacker influence over alias configuration or application calling patterns. Systems where popt is invoked only by privileged, non-interactive daemons processing system-controlled inputs face the lowest practical risk.

Red Hat's official CVSS 3.1 score of 2.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects a conservative, best-case impact - recording only low Availability impact and no Confidentiality or Integrity impact - while the vendor's own description and the assigned tags explicitly flag RCE and Memory Corruption potential. This discrepancy is significant: the CVSS impact metrics (C:N/I:N) do not align with the stated possibility of arbitrary code execution, suggesting scorers weighted the conditionality of the RCE chain heavily. EPSS data was not supplied; given local-only access, high attack complexity, and a chained exploitation requirement (the host application must also process corrupted data unsafely), opportunistic or automated exploitation is implausible. There is no CISA KEV listing and no known public proof-of-concept. The realistic threat is a targeted, post-access scenario by an attacker who already has local shell access and knowledge of a specific application's popt usage pattern. For most organizations, this fits a standard patching cadence rather than an out-of-band response. The official CVSS score likely understates worst-case impact but correctly captures that reliable exploitation is non-trivial.

A local attacker with low-privilege shell access on an RHEL system identifies a host application that makes repeated calls to poptStuffArgs or permits user-controlled alias nesting in a popt configuration file. By crafting deeply nested alias definitions or triggering the repeated-call path, the attacker incrementally advances the off-by-one write, corrupting adjacent memory structures. If the targeted host application subsequently processes those corrupted arguments without bounds validation - for example, dereferencing a corrupted pointer - the attacker redirects execution to attacker-controlled code running at the application's privilege level. No public proof-of-concept has been identified at time of analysis.