CVE-2026-103658
- Source
- https://cve.org/CVERecord?id=CVE-2026-103658
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103658.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-103658
- Aliases
-
- GHSA-p35p-2mw5-fj5j
- Downstream
- Related
- Published
- 2026-10-12T21:24:48Z
- Modified
- 2026-10-16T02:30:36Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- [none]
- Details
-
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.
- Database specific
{ "cna_assigner": "Anthropic", "cwe_ids": [ "CWE-122" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103658.json" }- References