Vulnerabilitates in software GNU Aspell

CVE ID

CVE-2026-75818

Publication date

06 October 2026

Vendor

GNU

Product

Aspell

Vulnerable versions

Omnes ante 0.60.8.3

Vulnerability type (CWE)

Heap-based buffer overflow (CWE-122)

Report source

Report to CERT Polska

CVE ID

CVE-2026-75819

Publication date

06 October 2026

Vendor

GNU

Product

Aspell

Vulnerable versions

Omnes ante 0.60.8.3

Vulnerability type (CWE)

Out-of-bounds Read (CWE-125)

Report source

Report to CERT Polska

CVE ID

CVE-2026-75820

Publication date

06 October 2026

Vendor

GNU

Product

Aspell

Vulnerable versions

Omnes ante 0.60.8.3

Vulnerability type (CWE)

Integer Overflow or Wraparound (CWE-190)

Report source

Report to CERT Polska

Description

CERT Polska reportum de vulnerabilitatibus in software GNU Aspell accepit et in coordinatione eorum revelationis participavit.

Vulnerabilitas CVE-2026-75818: GNU Aspell prezip-bin vulnerabilitatem heap-based buffer overflow continet in decompressor in prog/prezip.c. Decompressor spatia buffer non recte controllat, ita file compressum artificiosum operationes legere et scribere extra fines in heap causare potest. Impugnator qui usorem persuadet ut file compressum malitiosum cum prezip-bin tractet, corruptionem memoriae excitare potest, quae ad defectum processus ducit.

Haec quaestio in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f emendata est, quae in versione 0.60.8.3 dimittetur.

Vulnerabilitas CVE-2026-75819: GNU Aspell vulnerabilitatem out-of-bounds read continet in ReadOnlyDict::load() in readonly_ws.cpp. Cum file dictionarii binarii .rws onerat, campos offset ex capite file ut indices byte in buffer heap sine validando eorum fines adhibet. Impugnator hoc excitare potest persuadendo usorem ut aspell cum file dictionarii artificioso per --master, --dict-dir, aut configurationis optiones currat, quod ad divulgationem memoriae heap aut negationem servitii per defectum applicationis ducit.

Haec quaestio in commit 941953b25031bc9104e83f58e138a664b8dedc3f emendata est, quae in versione 0.60.8.3 dimittetur.

Vulnerabilitas CVE-2026-75820: GNU Aspell vulnerabilitatem truncationis integer continet in functione WritableDict::add() in modules/speller/default/writable.cpp. Cum onerat personalem wordlist, longitudo verbi ut byte singulum servatur, truncationem verborum cuius longitudo multipla est 256 causans. Hoc ad corruptionem heap ducit. Impugnator hoc explere potest persuadendo usorem ut aspell cum personalem wordlist artificiosam continens tale verbum currat, quod ad negationem servitii ducit.

Haec quaestio in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d emendata est, quae in versione 0.60.8.3 dimittetur.

Credits

Gratias agimus Michał Majchrowicz et Marcin Wyczechowski ex AFINE Team pro responsabili relatione vulnerabilitatis.

Plura de processu revelationis vulnerabilitatis coordinatae apud CERT Polska in https://cert.pl/en/cvd/ inveniuntur.

Vulnerabilitates Relatae

CVE-2026-75820 CVSS 1.8 LOW Deferred

CVE-2026-75820 - Integer Truncation Leading to Heap Corruption in GNU Aspell

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service. This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.

CVE-2026-75819 CVSS 1.8 LOW Deferred

CVE-2026-75819 - Out-of-bounds Read in GNU Aspell

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash. This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.

CVE-2026-75818 CVSS 1.8 LOW Deferred

CVE-2026-75818 - Heap Buffer Overflow in GNU Aspell's prezip utility

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash. This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.

Vulnerabilitates in software GNU Aspell

Vulnerabilitates Relatae

Plura ex cert.pl