This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| GNU | Aspell | unknown |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 06 Oct 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service. This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3. | |
| Title | Integer Truncation Leading to Heap Corruption in GNU Aspell | |
| First Time appeared |
Gnu
Gnu aspell |
|
| Weaknesses | CWE-190 | |
| CPEs | cpe:2.3:a:gnu:aspell:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Gnu
Gnu aspell |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-10-06T10:57:59.621Z
Reserved: 2026-08-18T10:13:29.246Z
Link: CVE-2026-75820
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-06T11:17:30.020
Modified: 2026-10-06T11:17:30.020
Link: CVE-2026-75820
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-190
Integer Overflow or Wraparound