CVE-2026-18839
popt-devel: popt-static: size_t underflow in singleOptionHelp
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 6, 2026
Updated · October 16, 2026
Description
An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.
Statement
This is a Low impact vulnerability where a size_t underflow in the popt library's help formatting function can occur when an application's option table is displayed in a narrow terminal with large option widths. This could potentially lead to memory allocation failures or out-of-bounds writes, but requires specific user interaction and terminal conditions, limiting its exploitability and overall risk.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVSS / CWE
CVSS 3.1 · 2.2CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE-191 · Integer Underflow (Wrap or Wraparound)