Skip to content
Fencer Intel
medium 5.9

CVE-2026-103658 json

GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictiona…

published 28d ago modified 24d ago also EUVD-2026-97965

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.

Patch / fix

  • aspell Debian 14 0.60.8.2-4

debian advisories DEBIAN-CVE-2026-103658

  • aspell openSUSE Tumbleweed 0.60.8.2-3.1

opensuse advisories openSUSE-SU-2026:12126-1

  • aspell AlmaLinux 9 12:0.60.8-9.el9_8
  • aspell AlmaLinux 8 12:0.60.6.1-23.el8_10

almalinux advisories ALSA-2026:92458ALSA-2026:92615

  • aspell Rocky Linux 9 2:0.60.8-9.el9_8
  • aspell Rocky Linux 8 2:0.60.6.1-23.el8_10

rocky linux advisories RLSA-2026:92458RLSA-2026:92615

  • aspell Azure Linux 3.0 0.60.8.1-2

azure linux advisories AZL-108060

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-103658 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-103658 updated cvss 7.8

aspell: aspell: Arbitrary code execution via crafted dictionary file

  • Red Hat Enterprise Linux 6 aspell 0.60.8.1-3.el10 Red Hat Enterprise Linux 7 aspell 0.60.8.1-3.el10 Red Hat Enterprise Linux 10 aspell 0.60.8.1-3.el10
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) aspell 0.60.6.1-23.el8_10
    fixed: vendor fix RHSA-2026:92615
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) aspell 0.60.8-9.el9_8
    fixed: vendor fix RHSA-2026:92458
  • Red Hat Enterprise Linux CRB (v. 8) aspell-devel 0.60.6.1-23.el8_10, aspell-debuginfo 0.60.6.1-23.el8_10, aspell-debugsource 0.60.6.1-23.el8_10
    fixed: vendor fix RHSA-2026:92615

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
26d ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/GNUAspell/aspell/security/advisories/GHSA-p35p-2mw5-fj5j referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

  • GNU Aspell

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.