CVE-2026-75819: Out-of-bounds Read in GNU Aspell
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonlyws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.
This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Aspellto a version that resolves this vulnerability.Fixed in 0.60.8.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users or applications that run GNU Aspell and load a binary .rws dictionary file from an untrusted source are exposed. Exploitation requires convincing a user to invoke aspell with the crafted dictionary through --master, --dict-dir, or relevant configuration options.
Does exploitation require an attacker to have access to the target system?
The attacker does not need prior privileges, but they need to supply a crafted dictionary file and have it loaded by Aspell. User interaction is required to run Aspell using that attacker-controlled dictionary.
What can happen if a crafted dictionary is loaded?
The out-of-bounds read can disclose heap memory or cause the Aspell application to crash, resulting in denial of service.
What version contains the fix?
The fix is in commit 941953b25031bc9104e83f58e138a664b8dedc3f and is stated to be released in GNU Aspell version 0.60.8.3.
What can be done before updating?
Do not load binary .rws dictionary files from untrusted sources. Restrict use of --master, --dict-dir, and configuration settings so they reference only trusted dictionary locations.