3 Vulnerabilities in GNU Aspell before 0.60.8.3
GNU Aspell before 0.60.8.3 has three flaws, including CVE-2026-75818, per CERT Polska.
38
Vulnerability2 · 1 read
CVE-2026-75818
Heap buffer overflow in GNU Aspell prezip-bin
- CVSS 4.0
- 1.8 low
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
GNU Aspell’s prezip-bin utility has a heap-based buffer overflow in the decompressor in prog/prezip.c. The decompressor does not properly check remaining buffer space, so a crafted compressed file can cause out-of-bounds reads and writes on the heap. An attacker must convince a user to process that file with prezip-bin; successful corruption can crash the process. Installations of GNU Aspell before 0.60.8.3 are affected. There is no known public proof of concept, and the issue is not listed in CISA KEV.
What to do: Upgrade GNU Aspell to 0.60.8.3 or later (the fix is commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f). Until then, do not run prezip-bin on compressed files from untrusted sources.
| Product | Affected |
|---|---|
| GNU Aspell (prezip-bin) | before 0.60.8.3 |
Estimated exposure
massmillions of Unix-like systems ship GNU Aspell, including prezip-bin — GNU Aspell is a long-standing spell checker packaged by major Linux and Unix distributions, so vulnerable prezip-bin binaries are widely installed, but the flaw only matters when a user processes an untrusted compressed file.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash. This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.
- Weakness
- CWE-122
- Vector
- CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X