AI Threat AlertCVE-2026-18739: popt: off-by-one in poptStuffArgs enables local corruption
LOWCVE-2026-18739 is an off-by-one memory write (CWE-787) in popt's poptStuffArgs function, a command-line parsing library, and it can corrupt internal program data when a host application calls it repeatedly or processes deeply nested aliases. Real-world risk is low: CVSS is 2.5 and the attack needs local access, low privileges and high complexity. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet. However, popt is bundled in many Red Hat OpenShift AI (RHOAI) container images (operators, model serving, MLflow, notebook controllers) and in OpenShift CoreOS nodes, with 695 downstream dependents, so the footprint is wide even if per-instance exploitability is limited. Apply Red Hat's fix in RHSA-2026:56984 through your normal patch cycle and rebuild or refresh affected RHOAI images. Do not treat this as an emergency.
What is the risk?
Low overall. The CVSS vector (AV:L/AC:H/PR:L) requires local access, a low-privileged account and conditions that are hard to reach (repeated calls or deep alias nesting). The listed impact is limited to availability (A:L), although the description notes that code execution is theoretically possible if the host application unsafely handles the corrupted data. There is no EPSS data, no public exploit and no KEV entry. The main amplifier is the breadth of affected RHOAI and OpenShift images, and the package's weak OpenSSF Scorecard (5.4/10) and 142 other CVEs signal a modest maintenance-hygiene concern. Exposure depends on whether host applications pass attacker-influenced alias or argument data to popt.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Apply Red Hat advisory RHSA-2026:56984 and update the popt package on OpenShift CoreOS nodes and base images. 2) Rebuild or pull updated RHOAI operator and component images that bundle popt. 3) Inventory container images with an SBOM scan for the popt library to find affected workloads. 4) Restrict shell and exec access to containers and nodes, and enforce least privilege, to limit the local-attacker precondition. 5) Monitor for unexpected crashes or segfaults in processes that parse command-line arguments or aliases. 6) Track the Red Hat Bugzilla entry (2510737) for further updates.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-18739?
CVE-2026-18739 is an off-by-one memory write (CWE-787) in popt's poptStuffArgs function, a command-line parsing library, and it can corrupt internal program data when a host application calls it repeatedly or processes deeply nested aliases. Real-world risk is low: CVSS is 2.5 and the attack needs local access, low privileges and high complexity. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet. However, popt is bundled in many Red Hat OpenShift AI (RHOAI) container images (operators, model serving, MLflow, notebook controllers) and in OpenShift CoreOS nodes, with 695 downstream dependents, so the footprint is wide even if per-instance exploitability is limited. Apply Red Hat's fix in RHSA-2026:56984 through your normal patch cycle and rebuild or refresh affected RHOAI images. Do not treat this as an emergency.
Is CVE-2026-18739 actively exploited?
No confirmed active exploitation of CVE-2026-18739 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-18739?
1) Apply Red Hat advisory RHSA-2026:56984 and update the popt package on OpenShift CoreOS nodes and base images. 2) Rebuild or pull updated RHOAI operator and component images that bundle popt. 3) Inventory container images with an SBOM scan for the popt library to find affected workloads. 4) Restrict shell and exec access to containers and nodes, and enforce least privilege, to limit the local-attacker precondition. 5) Monitor for unexpected crashes or segfaults in processes that parse command-line arguments or aliases. 6) Track the Red Hat Bugzilla entry (2510737) for further updates.
What systems are affected by CVE-2026-18739?
This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps platforms, notebook and workbench environments, training pipelines, Kubernetes-based AI platforms.
What is the CVSS score for CVE-2026-18739?
CVE-2026-18739 has a CVSS v3.1 base score of 2.5 (LOW).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0112Machine CompromiseCompliance Controls Affected
What are the technical details?
Original Advisory
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
Exploitation Scenario
An attacker with a low-privileged local foothold, such as a compromised notebook or workbench container in an RHOAI cluster, targets a host binary that uses popt and processes user-controlled alias definitions. By crafting deeply nested aliases or driving repeated poptStuffArgs calls, the attacker triggers a one-byte overflow that corrupts adjacent internal data. If the host application then unsafely uses that data, the attacker could crash the process or in theory redirect execution. The high attack complexity and the need for application-specific conditions make reliable exploitation unlikely.
Weaknesses (CWE)
CWE-787 — Out-of-bounds Write: The product writes data past the end, or before the beginning, of the intended buffer.
- [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:LReferences
- access.redhat.com/errata/RHSA-2026:56984vendor-advisoryx_refsource_REDHAT
- access.redhat.com/security/cve/CVE-2026-18739vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
Timeline
Related Vulnerabilities
CVE-2025-1537910.0MLflow: RCE via unsanitized model dependency specs
Same package: mlflowCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same package: mlflowCVE-2023-27809.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflowCVE-2023-11779.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflowCVE-2026-26359.8mlflow: security flaw enables exploitation
Same package: mlflow