CVE-2026-103658

Name of the Vulnerable Software and Affected Versions GNU Aspell versions prior to 0.60.8.3

Description A heap-based buffer overflow write exists in the read-only dictionary loader. The String::reserve() function in common/string.hpp performs a capacity check using a signed integer ((int)s + 1), which allows a requested size of 0x7FFFFFFF to wrap to a negative value, preventing the backing buffer from growing. The ReadOnlyDict::load() function in modules/speller/default/readonly ws.cpp passes unvalidated 32-bit size fields from a .rws dictionary header into this path. Consequently, a crafted .rws file containing a valid endian marker and an oversized length field, such as lang name size set to 0x7FFFFFFF, allows attacker-controlled data to be written out of bounds past an undersized heap allocation. This can lead to heap memory corruption, resulting in denial of service or potential code execution if a victim is induced to load a malicious dictionary.

Recommendations Update to version 0.60.8.3.