RHSA-2026:99575: Important: aspell security update
GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.Security Fix(es): aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/aspellto a version that resolves this vulnerability.Fixed in 0.60.6.1-22.el8_8.1 - Upgrade
Upgrade
redhat/aspell-debuginfoto a version that resolves this vulnerability.Fixed in 0.60.6.1-22.el8_8.1 - Upgrade
Upgrade
redhat/aspell-debugsourceto a version that resolves this vulnerability.Fixed in 0.60.6.1-22.el8_8.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using GNU Aspell are exposed, including applications that use Aspell as a library and systems using it as an independent spell checker. Exploitation involves a crafted dictionary file.
What could an attacker achieve?
A crafted dictionary file can lead to arbitrary code execution.
Which Red Hat packages are covered by this update?
The update lists redhat/aspell, redhat/aspell-debuginfo, and redhat/aspell-debugsource, along with the specified Red Hat Enterprise Linux Server, Power LE SAP Solutions, x86_64 SAP Solutions, and x86_64 Extended Life Cycle Long Life offerings.