CVE-2026-75819— Out-of-bounds Read in GNU Aspell
Quick assessment
Affected
GNU Aspell
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GNU Aspell 在 文件中的 函数中存在一个越界读取漏洞。当加载二进制 .rws 词典文件时，该函数使用文件头中的偏移量字段作为堆缓冲区的字节索引，但未对这些索引进行边界验证。攻击者可以通过诱导用户运行 aspell 并提供恶意构造的词典文件（通过 --master、--dict-dir 或配置选项指定），从而触发此漏洞，导致堆内存信息泄露或因应用程序崩溃而引发拒绝服务。 该问题已在提交 941953b25031bc9104e83f58e138a664b8dedc3f 中修复，并将在版本 0.60.8.3 中
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75819
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Out-of-bounds Read in GNU Aspell
Source: CVE Program / CVE List V5
Vulnerability Description
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.
This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-75819
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75819
请登录查看更多情报信息。
Other References for CVE-2026-75819 (2)
-
http://aspell.net/ product
-
https://cert.pl/en/posts/2026/10/CVE-2026-75818 third-party-advisory
Same Patch Batch · GNU · 2026-10-06 · 3 CVEs total
| CVE-2026-75820 | 1.8 LOW | Integer Truncation Leading to Heap Corruption in GNU Aspell |
| CVE-2026-75818 | 1.8 LOW | Heap Buffer Overflow in GNU Aspell's prezip utility |
IV. Related Vulnerabilities
Same vendor: GNU
-
CVE-2026-75820
Integer Truncation Leading to Heap Corruption in GNU Aspell -
CVE-2026-75818
Heap Buffer Overflow in GNU Aspell's prezip utility -
CVE-2026-97876
Bypass of GRUB lockdown restriction in Secure Boot mode via -
CVE-2026-100310
GNU libextractor before 1.16 Privilege Escalation via LIBEXT -
CVE-2026-96269
Emacs 28.1-31.1 read-symbol-shorthands远程代码执行漏洞
Same weakness: CWE-125
-
CVE-2026-106026
tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap J -
CVE-2026-105838
libmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Modul -
CVE-2026-105775
vllm-project vLLM Completions Request mamba_mixer2.py conv_s -
CVE-2026-104043
Sssd: sssd: denial of service via undersized packet parsing -
CVE-2026-104042
Sssd: sssd: denial of service via out-of-bounds read in pam
V. Comments for CVE-2026-75819
No comments yet