CVE-2026-75819
published 2026-10-06CVE-2026-75819: GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset…
PriorityP49low1.8CVSS 4.0
AVLACHATNPRNUIAVCNVINVALSCLSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.12%
1.6th percentile
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.
This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | aspell | < 0.60.8.3 | 0.60.8.3 |
| gnu | aspell | — | — |
CVSS provenance
nvdv4.01.8LOWCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat1.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
aspell: aspell: Denial of Service via crafted dictionary file
vendor_redhat·2026-10-06·CVSS 1.8
CVE-2026-75819 [LOW] CWE-125 aspell: aspell: Denial of Service via crafted dictionary file
aspell: aspell: Denial of Service via crafted dictionary file
A flaw was found in aspell. When loading a binary dictionary file, the application fails to validate offset fields from the file header against buffer boundaries. By convincing a user to process a specially crafted dictionary file, an attacker can trigger an out-of-bounds read, leading to an application crash that results in a Denial of Service (DoS) or the potential disclosure of heap memory contents.
Statement: This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires user interaction to process an untrusted custom dictionary, limiting the attack surface to local or user-assisted scenarios. In typical enterprise environments, GNU Aspell is invoked as an ephemeral command-line utility o
GHSA
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp.
ghsa_unreviewed·2026-10-06
CVE-2026-75819 [LOW] CWE-125 GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp.
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.
This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-75819 aspell: aspell: Denial of Service via crafted dictionary file
bugzilla·2026-10-06·CVSS 1.8
CVE-2026-75819 [LOW] CVE-2026-75819 aspell: aspell: Denial of Service via crafted dictionary file
CVE-2026-75819 aspell: aspell: Denial of Service via crafted dictionary file
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.
This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.
Bugzilla
CVE-2026-75819 aspell: aspell: Denial of Service via crafted dictionary file [fedora-all]
bugzilla·2026-10-06·CVSS 1.8
CVE-2026-75819 [LOW] CVE-2026-75819 aspell: aspell: Denial of Service via crafted dictionary file [fedora-all]
CVE-2026-75819 aspell: aspell: Denial of Service via crafted dictionary file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via applicat
2026-10-06
Published