CVE-2026-75820
Integer Truncation Leading to Heap Corruption in GNU Aspell
GNU Aspell
CVSS
1.8LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.60.8.3AspellCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.
This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.
Text from CVE List
Affected versions 1
- Aspellaffected: all versions before 0.60.8.3CVE List