GNU Aspell up to 0.60.8.2 Dictionary Loader common/string.hpp String::reserve heap-based overflow

Summaryinfo

A vulnerability was found in GNU Aspell up to 0.60.8.2 and classified as critical. This affects the function String::reserve of the file common/string.hpp of the component Dictionary Loader. Such manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2026-103658. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in GNU Aspell up to 0.60.8.2. Affected by this issue is the function String::reserve of the file common/string.hpp of the component Dictionary Loader. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

GNU Aspell through 0.60.8.2 contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in 0.60.8.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-103658 since 10/01/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 0.60.8.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• GNU

Name

• Aspell

Version

• 0.60.8.0
• 0.60.8.1
• 0.60.8.2

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion