CVE-2026-75820: Integer Truncation Leading to Heap Corruption in GNU Aspell
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.
This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.
Other sources
Integer Truncation Leading to Heap Corruption in GNU Aspell
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Aspellto a version that resolves this vulnerability.Fixed in 0.60.8.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who run GNU Aspell with a personal wordlist are exposed if they can be persuaded to use a crafted wordlist containing a word whose length is a multiple of 256. The described impact is denial of service through heap corruption.
What user interaction is required for exploitation?
An attacker must convince a user to run aspell with the crafted personal wordlist. The CVSS vector also indicates local attack access and required user interaction.
Which version contains the fix?
The fix is in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and is stated to be released in GNU Aspell version 0.60.8.3.