Read the docs
TI-2026-68407 Aliases CVE-2026-75819GHSA-5c9p-3r63-49hf

Out-of-bounds read in GNU Aspell dictionary loading

Priority LOW 9CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

GNU Aspell versions from 0 before 0.60.8.3 are affected. The ReadOnlyDict::load() function uses offset fields from a binary .rws dictionary header as heap buffer indices without bounds checks, which is an out-of-bounds read (CWE-125). An attacker who convinces a user to run aspell with a crafted dictionary file can disclose heap memory or crash the application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash. This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Fix Partial Aspell (GNU): 0.60.8.3Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUAspellbefore 0.60.8.30.60.8.3Patch availableCNA
  • Aspell VendorGNU Affected before 0.60.8.3 Fixed in 0.60.8.3 Patch available CNA

Remediation

Upgrade GNU Aspell to version 0.60.8.3, which contains the fix. Red Hat Enterprise Linux 6 has no fix planned, and Red Hat Enterprise Linux 7, 8, 9 and 10 have no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Aspell (GNU) Fixed in 0.60.8.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GNU Aspell 0.60.8.3

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-68408 Integer truncation leads to heap corruption in GNU AspellPriority LOW 9
    • TI-2026-68406 Heap buffer overflow in GNU Aspell prezip-bin decompressorPriority LOW 9
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-75819
  2. 2026-10-06 Alias added: GHSA-5c9p-3r63-49hf

References

Advisory 1

Other 1

  • TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences