RHSA-2026:98590: Important: aspell security update
GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.Security Fix(es): aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/aspellto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1 - Upgrade
Upgrade
redhat/aspell-debuginfoto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1 - Upgrade
Upgrade
redhat/aspell-debugsourceto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1 - Upgrade
Upgrade
redhat/aspell-develto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1 - Upgrade
Upgrade
redhat/aspellto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1.aa - Upgrade
Upgrade
redhat/aspell-debuginfoto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1.aa - Upgrade
Upgrade
redhat/aspell-debugsourceto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1.aa - Upgrade
Upgrade
redhat/aspell-develto a version that resolves this vulnerability.Fixed in 0.60.8.1-3.el10_3.1.aa
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to cause Aspell to process a crafted dictionary file. The reported impact is arbitrary code execution.
Which installed packages should be reviewed for this update?
Review systems with redhat/aspell installed, along with related redhat/aspell-debuginfo, redhat/aspell-debugsource, and redhat/aspell-devel packages.