RLSA-2026:98590: Important: aspell security update
GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.
Security Fix(es):
aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/aspell-develto a version that resolves this vulnerability.Fixed in 2:0.60.8.1-3.el10_3.1 - Upgrade
Upgrade
rocky-linux/aspellto a version that resolves this vulnerability.Fixed in 2:0.60.8.1-3.el10_3.1 - Upgrade
Upgrade
rocky-linux/aspell-debuginfoto a version that resolves this vulnerability.Fixed in 2:0.60.8.1-3.el10_3.1 - Upgrade
Upgrade
rocky-linux/aspell-debugsourceto a version that resolves this vulnerability.Fixed in 2:0.60.8.1-3.el10_3.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates local access and user interaction are required, while no privileges are required. Exploitation involves a crafted dictionary file.
Which Rocky Linux packages should be checked for this update?
The advisory lists aspell, aspell-devel, aspell-debuginfo, and aspell-debugsource.
What is the potential impact if exploitation succeeds?
The issue can lead to arbitrary code execution. The CVSS vector rates confidentiality, integrity, and availability impact as high.