GNU Aspell 0.60.8 Speller writable.cpp WritableDict::add heap-based overflow

Summaryinfo

A vulnerability was found in GNU Aspell. It has been rated as problematic. Impacted is the function WritableDict::add of the file modules/speller/default/writable.cpp of the component Speller. The manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2026-75820. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in GNU Aspell. This issue affects the function WritableDict::add of the file modules/speller/default/writable.cpp of the component Speller. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is availability. The summary by CVE is:

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service. This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.

It is possible to read the advisory at cert.pl. The identification of this vulnerability is CVE-2026-75820 since 08/18/2026. The exploitation is known to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.60.8.3 eliminates this vulnerability. Applying the patch 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-93366). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• GNU

Name

• Aspell

Version

• 0.60.8

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion