{"id":"CVE-2026-75819","summary":"Out-of-bounds Read in GNU Aspell","details":"GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.\n\n\n\nThis issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.","modified":"2026-10-21T10:42:52.581768179Z","published":"2026-10-06T10:57:56.333Z","related":["openSUSE-SU-2026:12079-1"],"database_specific":{"cna_assigner":"CERT-PL","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75819.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"0.60.8.3"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}]},"references":[{"type":"WEB","url":"http://aspell.net/"},{"type":"ADVISORY","url":"https://cert.pl/en/posts/2026/10/CVE-2026-75818"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75819.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75819"},{"type":"PACKAGE","url":"https://github.com/GNUAspell/aspell"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gnuaspell/aspell","events":[{"introduced":"0"},{"fixed":"941953b25031bc9104e83f58e138a664b8dedc3f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"941953b25031bc9104e83f58e138a664b8dedc3f"}],"source":"DESCRIPTION"},{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"941953b25031bc9104e83f58e138a664b8dedc3f"}]}]}}],"versions":["rel-0.60.6.1","rel-0.60.7-20110707"],"database_specific":{"vanir_signatures_modified":"2026-10-21T10:42:52Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75819.json","vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["148589746588930418281263272817208851107","211707672409030430124837387129621350","220338774589568777499027171277846396936","292242164588772963792858177133535664995"]},"id":"CVE-2026-75819-e986044b","signature_type":"Line","signature_version":"v1","source":"https://github.com/gnuaspell/aspell/commit/941953b25031bc9104e83f58e138a664b8dedc3f","target":{"file":"modules/speller/default/readonly_ws.cpp"}},{"id":"CVE-2026-75819-fd5a7e32","signature_type":"Function","signature_version":"v1","source":"https://github.com/gnuaspell/aspell/commit/941953b25031bc9104e83f58e138a664b8dedc3f","target":{"file":"modules/speller/default/readonly_ws.cpp","function":"ReadOnlyDict::load"},"deprecated":false,"digest":{"function_hash":"25846599009164280242805027001039857875","length":3088}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N"}]}