CVE-2026-103658

GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.

Database specific

{
    "cna_assigner": "Anthropic",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103658.json"
}

References

Affected packages

Git / github.com/gnuaspell/aspell

Affected ranges

Type

GIT

Repo

https://github.com/gnuaspell/aspell

Events

Introduced

3de79d40aee4e9ccdc0d83856637949801a3d33b

Last Affected

3de79d40aee4e9ccdc0d83856637949801a3d33b

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.60.8.2"
                },
                {
                    "last_affected": "0.60.8.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        }
    ]
}

Affected versions

0.*

0.60.8.2

rel-0.*

rel-0.60.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103658.json"