Source: aspell X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for aspell. CVE-2026-103658[0]: | GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains | a heap-based buffer overflow write (CWE-122) in its read-only | dictionary loader. String::reserve() in common/string.hpp computes | its capacity check with a signed int ((int)s + 1), so a requested | size of 0x7FFFFFFF wraps negative and the backing buffer is never | grown. ReadOnlyDict::load() in | modules/speller/default/readonly_ws.cpp passes the unvalidated | 32-bit size fields from a .rws dictionary header into this path, so | a crafted .rws file with a valid endian marker (12345678) and an | oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes | attacker-controlled data to be written out of bounds past an | undersized heap allocation. An attacker who induces a victim to load | a malicious dictionary — for example via aspell dump master <file> — | can corrupt heap memory, resulting in denial of service and | potentially code execution. Fixed in b830b6e and will be fixed in | release 0.60.8.3. https://github.com/GNUAspell/aspell/security/advisories/GHSA-p35p-2mw5-fj5j https://github.com/GNUAspell/aspell/commit/b830b6e If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-103658 https://www.cve.org/CVERecord?id=CVE-2026-103658 Please adjust the affected versions in the BTS as needed.
