SUSE-SU-2026:5163-1: Security update for aspell

Q: Which systems and packages are in scope for this update?

The update applies to SUSE Linux Enterprise Server 12 SP5 LTSS on aarch64, ppc64le, s390x, and x86_64. Listed packages include aspell, libaspell15, aspell-devel, aspell-ispell, and the associated debug and debuginfo packages.

Q: What attacker-controlled content is most relevant to exploitation?

A crafted dictionary file can enable arbitrary code execution. The other issues affect dictionary loading, dictionary addition, and decompression code paths, with impacts including heap corruption, memory disclosure, and application crashes.

Q: What impact should be considered during prioritization?

The fixed flaws include arbitrary code execution, heap-based memory corruption, out-of-bounds memory disclosure, and denial of service through process crashes. Systems that process untrusted dictionary files or invoke the affected Aspell functionality should be prioritized.

Published Nov 10, 2026

Updated

This update for aspell fixes the following issues:

- CVE-2026-75818: heap-based buffer overflow in the decompressor in prog/prezip.c can lead to memory corruption and process crash (bsc#1284337). - CVE-2026-75819: out-of-bounds read in ReadOnlyDict::load() of readonlyws.cpp can lead to heap memory disclosure or application crash (bsc#1284338). - CVE-2026-75820: integer truncation in WritableDict::add() of modules/speller/default/writable.cpp can lead to heap corruption (bsc#1284339). - CVE-2026-103658: Arbitrary code execution via crafted dictionary file (bsc#1285066).

Other sources

This update for aspell fixes the following issues: CVE-2026-75818: heap-based buffer overflow in the decompressor in prog/prezip.c can lead to memory corruption and process crash (bsc#1284337). CVE-2026-75819: out-of-bounds read in ReadOnlyDict::load() of readonlyws.cpp can lead to heap memory disclosure or application crash (bsc#1284338). CVE-2026-75820: integer truncation in WritableDict::add() of modules/speller/default/writable.cpp can lead to heap corruption (bsc#1284339). CVE-2026-103658: Arbitrary code execution via crafted dictionary file (bsc#1285066).

— SUSE

Affected Software

23 affected componentsFixes available

suse/aspell<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell<0.60.6.1-18.18.1

0.60.6.1-18.18.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libaspell15-debuginfo<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell-devel<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/libaspell15<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell-debuginfo<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell-ispell<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell-debugsource<0.60.6.1-18.18.1

0.60.6.1-18.18.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS (s390x x86_64)

Any of the following

suse/libaspell15<32bit-0.60.6.1-18.18.1

32bit-0.60.6.1-18.18.1

suse/libaspell15-debuginfo<32bit-0.60.6.1-18.18.1

32bit-0.60.6.1-18.18.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)

Any of the following

suse/libaspell15-debuginfo<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell-devel<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/libaspell15<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/libaspell15<32bit-0.60.6.1-18.18.1

32bit-0.60.6.1-18.18.1

suse/libaspell15-debuginfo<32bit-0.60.6.1-18.18.1

32bit-0.60.6.1-18.18.1

suse/aspell-debuginfo<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell-ispell<0.60.6.1-18.18.1

0.60.6.1-18.18.1

suse/aspell-debugsource<0.60.6.1-18.18.1

0.60.6.1-18.18.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/aspell to a version that resolves this vulnerability.
Fixed in 0.60.6.1-18.18.1
Upgrade
Upgrade suse/libaspell15-debuginfo to a version that resolves this vulnerability.
Fixed in 0.60.6.1-18.18.1
Upgrade
Upgrade suse/aspell-devel to a version that resolves this vulnerability.
Fixed in 0.60.6.1-18.18.1
Upgrade
Upgrade suse/libaspell15 to a version that resolves this vulnerability.
Fixed in 0.60.6.1-18.18.1
Upgrade
Upgrade suse/aspell-debuginfo to a version that resolves this vulnerability.
Fixed in 0.60.6.1-18.18.1
Upgrade
Upgrade suse/aspell-ispell to a version that resolves this vulnerability.
Fixed in 0.60.6.1-18.18.1
Upgrade
Upgrade suse/aspell-debugsource to a version that resolves this vulnerability.
Fixed in 0.60.6.1-18.18.1
Upgrade
Upgrade suse/libaspell15 to a version that resolves this vulnerability.
Fixed in 32bit-0.60.6.1-18.18.1
Upgrade
Upgrade suse/libaspell15-debuginfo to a version that resolves this vulnerability.
Fixed in 32bit-0.60.6.1-18.18.1
Upgrade
Upgrade aspell to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-5163
Upgrade
Upgrade aspell to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-5163

Event History

Nov 10, 2026

Advisory Published

via OSV·09:42 AM

Data Sourced

via OSV·09:42 AM

DescriptionAffected Software

Advisory Published

via SUSE·09:42 AM

Data Sourced

via SUSE·09:42 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems and packages are in scope for this update?

The update applies to SUSE Linux Enterprise Server 12 SP5 LTSS on aarch64, ppc64le, s390x, and x86_64. Listed packages include aspell, libaspell15, aspell-devel, aspell-ispell, and the associated debug and debuginfo packages.

What attacker-controlled content is most relevant to exploitation?

A crafted dictionary file can enable arbitrary code execution. The other issues affect dictionary loading, dictionary addition, and decompression code paths, with impacts including heap corruption, memory disclosure, and application crashes.

What impact should be considered during prioritization?

The fixed flaws include arbitrary code execution, heap-based memory corruption, out-of-bounds memory disclosure, and denial of service through process crashes. Systems that process untrusted dictionary files or invoke the affected Aspell functionality should be prioritized.

SUSE-SU-2026:5163-1: Security update for aspell

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems and packages are in scope for this update?

What attacker-controlled content is most relevant to exploitation?

What impact should be considered during prioritization?

Company

Resources

Contact

Frequently Asked Questions

Which systems and packages are in scope for this update?

What attacker-controlled content is most relevant to exploitation?

What impact should be considered during prioritization?