CVE-2026-103658: Buffer Overflow
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonlyws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. langnamesize = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.
Other sources
GNU Aspell through 0.60.8.2 contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonlyws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. langnamesize = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in 0.60.8.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Aspellto a version that resolves this vulnerability.Fixed in 0.60.8.3Patch b830b6e
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using GNU Aspell through 0.60.8.2 are exposed when they load an attacker-controlled .rws dictionary file. The attacker needs to induce a local invocation that processes the malicious dictionary, such as aspell dump master <file>.
What does an attacker need to exploit it?
The attacker needs to provide a crafted .rws file with a valid endian marker and an oversized unvalidated 32-bit header length field. No privileges or user interaction are required by the vulnerability vector itself, but the malicious dictionary must be loaded by Aspell.
What should be done if patching is not immediately possible?
Do not load .rws dictionary files from untrusted sources. Restrict dictionary-loading workflows, including commands such as aspell dump master, to known-good dictionary files until GNU Aspell can be updated to 0.60.8.3.