Read the docs
TI-2026-68408 Aliases CVE-2026-75820GHSA-7gjr-5wh9-g7w9

Integer truncation leads to heap corruption in GNU Aspell

Priority LOW 9CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

GNU Aspell before 0.60.8.3 contains an integer truncation flaw (CWE-190) in WritableDict::add(). When loading a personal wordlist, the word length is stored in a single byte, so words whose length is a multiple of 256 are truncated, which corrupts the heap. An attacker who convinces a user to run aspell with a crafted personal wordlist can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service. This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix Partial Aspell (GNU): 0.60.8.3Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUAspellbefore 0.60.8.30.60.8.3Patch availableCNA
  • Aspell VendorGNU Affected before 0.60.8.3 Fixed in 0.60.8.3 Patch available CNA

Remediation

Upgrade GNU Aspell to version 0.60.8.3, which contains the fix. Red Hat lists Red Hat Enterprise Linux 6 with no fix planned and Red Hat Enterprise Linux 7, 8, 9 and 10 with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Aspell (GNU) Fixed in 0.60.8.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GNU Aspell 0.60.8.3

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-68407 Out-of-bounds read in GNU Aspell dictionary loadingPriority LOW 9
    • TI-2026-68406 Heap buffer overflow in GNU Aspell prezip-bin decompressorPriority LOW 9
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-75820
  2. 2026-10-06 Alias added: GHSA-7gjr-5wh9-g7w9
  3. 2026-10-07 Affected versions changed · Red Hat

References

Advisory 1

Other 1

  • TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences