Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
5130 articles · 251391 vulns · 37/41 feeds (7d)
← Back to list
2.5
CVE-2026-18739EXPLOITEDPATCHED
red hat · red hat enterprise linux

Popt-devel: popt-static: off-by-one in poptstuffargs

Description

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.

Affected Products

VendorProductVersions
red hatred hat enterprise linux1.1.1

References

  • https://access.redhat.com/errata/RHSA-2026:56984(vendor-advisory, x_refsource_REDHAT)
  • https://access.redhat.com/security/cve/CVE-2026-18739(vdb-entry, x_refsource_REDHAT)
  • https://bugzilla.redhat.com/show_bug.cgi?id=2510737(issue-tracking, x_refsource_REDHAT)

Related News (2 articles)

Tier B
CERT-FR17h ago
Multiples vulnérabilités dans les produits VMware (26 octobre 2026)
→ No new info (linked only)
Tier C
VulDB83d ago
CVE-2026-18739 | popt poptStuffArgs off-by-one
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.12.5 NONE
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
*
CWECWE-787
PublishedAug 4, 2026
Last enriched83d ago
Tags
remote code executionfile manipulationdenial of servicemultiple vulnerabilities
Trending Score51
Source articles2
Independent2
Info Completeness0/14
Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

NONECVE-2026-103242EXP
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
Trending: 55
NONECVE-2026-18477EXP
Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
Trending: 51
NONECVE-2026-18508EXP
Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
Trending: 51
NONECVE-2026-110926EXP
Openssh: openssh: shared lz77 compression dictionary leaks plaintext across channels
Trending: 50
NONECVE-2026-18839EXP
Popt-devel: popt-static: size_t underflow in singleoptionhelp
Trending: 50

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Aug 4, 2026
Discovered by ZDM
Aug 4, 2026
Actively Exploited
Aug 31, 2026
Exploit Available
Aug 31, 2026
Patch Available
Aug 31, 2026