Bug 2510809 (CVE-2026-18743)

Summary: CVE-2026-18743 popt-devel: popt-static: Short realloc in poptConfigFileToString
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, kshier, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2511606    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-03 21:16:18 UTC 
Buffer growth maxargvlen*2 can under-allocate relative to accumulated argvlen, yielding small heap overflow (~11 bytes / ~9 attacker-chosen) on crafted config content.

Flow: Privileged or unprivileged host loads attacker-influenced popt config → poptConfigFileToString → realloc/strcat overflow → heap metadata corruption (reporter).

Earliest affected is `popt-1_11-release` tag in git. `poptConfigFileToString()` must be explicitly called in order for this to be reachable, which is not used by the internal source.

src/poptparse.c:191-224