{"id":"AZL-108060","summary":"CVE-2026-103658 affecting package aspell 0.60.8.1-1","details":"GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master \u003cfile\u003e — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.","modified":"2026-10-15T14:16:40.290573629Z","published":"2026-10-12T22:17:03Z","upstream":["CVE-2026-103658"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103658"}],"affected":[{"package":{"name":"aspell","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/aspell"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.60.8.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108060.json"}}],"schema_version":"1.9.0"}