Fix CVE-2026-75818, 75819, 75820 in aspell

[Joe Locash]

Source: ​https://cert.pl/en/posts/2026/10/CVE-2026-75818/

CERT Polska has received a report about vulnerabilities in GNU Aspell
software and participated in coordination of their disclosure.

The vulnerability CVE-2026-75818: GNU Aspell prezip-bin contains a
heap-based buffer overflow vulnerability in the decompressor in
prog/prezip.c. The decompressor does not properly check buffer space,
so a crafted compressed file can cause out-of-bounds read and write
operations on the heap. An attacker who convinces a user to process a
malicious compressed file with prezip-bin can trigger memory
corruption, leading to a processs crash.

This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f
which will be released in version 0.60.8.3.


The vulnerability CVE-2026-75819: GNU Aspell contains an out-of-bounds
read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When
loading a binary .rws dictionary file, it uses offset fields from the
file header as byte indices into a heap buffer without validating
their bounds. An attacker can trigger this by convincing a user to run
aspell with a crafted dictionary file supplied through --master,
--dict-dir, or configuration options, leading to heap memory
disclosure or a denial of service via application crash.

This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f
which will be released in version 0.60.8.3.


The vulnerability CVE-2026-75820: GNU Aspell contains an integer
truncation vulnerability in the WritableDict::add() function in
modules/speller/default/writable.cpp. When loading a personal
wordlist, the word length is stored as a single byte, causing
truncation for words whose length is a multiple of 256. This leads to
heap corruption. An attacker can exploit this by convincing a user to
run aspell with a crafted personal wordlist containing such a word,
resulting in denial of service.

This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d
which will be released in version 0.60.8.3.