Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.5
openeuler popt library can crash from crafted config
published 1 month ago
Summary
The popt library used in openeuler can be tricked by a specially prepared configuration file, causing it to corrupt its own memory. This may make the program stop working, leading to a denial of service. Apply the provided security update to fix the memory handling issue.
What to do
- Update openeuler popt to version 1.19-6.oe2403sp3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP3 | openeuler | popt |
< 1.19-6.oe2403sp3 Fix: upgrade to 1.19-6.oe2403sp3
|
Original advisory text
popt security update
The popt library exists essentially for parsing command line options. Some specific advantages of popt are no global variables (allowing multiple passes in parsing argv), parsing an arbitrary array of argv-style elements (allowing parsing of command-line-strings from any source), a standard method of option aliasing, ability to exec external option filters, and automatic generation of help and usage messages.
Security Fix(es):
A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).(CVE-2026-18743)
Security Fix(es):
A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).(CVE-2026-18743)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-18743 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published20 Sep 2026
Updated20 Sep 2026
First seen20 Sep 2026
Sources
OESA-2026-3943 · OSV
Track software like this
Free during beta