{"id":"DEBIAN-CVE-2026-103658","details":"GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master \u003cfile\u003e — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.","modified":"2026-10-15T09:47:43.546011075Z","published":"2026-10-12T22:17:03.143Z","upstream":["CVE-2026-103658"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-103658"}],"affected":[{"package":{"name":"aspell","ecosystem":"Debian:12","purl":"pkg:deb/debian/aspell?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.60.8-4","0.60.8-5","0.60.8-6","0.60.8.1-1","0.60.8.1-2","0.60.8.1-3","0.60.8.1-4","0.60.8.1-5","0.60.8.1-6","0.60.8.2-1","0.60.8.2-2","0.60.8.2-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-103658.json"}},{"package":{"name":"aspell","ecosystem":"Debian:13","purl":"pkg:deb/debian/aspell?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.60.8.1-4","0.60.8.1-5","0.60.8.1-6","0.60.8.2-1","0.60.8.2-2","0.60.8.2-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-103658.json"}},{"package":{"name":"aspell","ecosystem":"Debian:14","purl":"pkg:deb/debian/aspell?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.60.8.1-4","0.60.8.1-5","0.60.8.1-6","0.60.8.2-1","0.60.8.2-2","0.60.8.2-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-103658.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}