UBUNTU-CVE-2026-103658

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-103658
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-103658
Upstream
Published
2026-10-12T22:17:00Z
Modified
2026-10-17T12:57:58Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.

References

Affected packages

Ubuntu:18.04:LTS
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.7~20110707-4
0.60.7~20110707-4ubuntu0.1
0.60.7~20110707-4ubuntu0.2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.7~20110707-4ubuntu0.2"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.7~20110707-4ubuntu0.2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"
Ubuntu:20.04:LTS
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.7-3
0.60.8-1
0.60.8-1build1
0.60.8-1ubuntu0.1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.8-1ubuntu0.1"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.8-1ubuntu0.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"
Ubuntu:22.04:LTS
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.8-3
0.60.8-4
0.60.8-4build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.8-4build1"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.8-4build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"
Ubuntu:24.04:LTS
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.8-5
0.60.8-6
0.60.8.1-1
0.60.8.1-1build1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.8.1-1build1"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.8.1-1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"
Ubuntu:26.04:LTS
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.8.1-4
0.60.8.1-6
0.60.8.2-1
0.60.8.2-3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.8.2-3"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.8.2-3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"
Ubuntu:26.10
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.8.2-3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.8.2-3"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.8.2-3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"
Ubuntu:Pro:14.04:LTS
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.7~20110707-1build1
0.60.7~20110707-1ubuntu1
0.60.7~20110707-1ubuntu1+esm1
0.60.7~20110707-1ubuntu1+esm2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.7~20110707-1ubuntu1+esm2"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.7~20110707-1ubuntu1+esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"
Ubuntu:Pro:16.04:LTS
aspell

Package

Name
aspell
Purl
pkg:deb/ubuntu/aspell?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.60.7~20110707-3
0.60.7~20110707-3build1
0.60.7~20110707-3ubuntu0.1
0.60.7~20110707-3ubuntu0.1+esm1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "aspell",
            "binary_version":  "0.60.7~20110707-3ubuntu0.1+esm1"
        },
        {
            "binary_name":  "libaspell15",
            "binary_version":  "0.60.7~20110707-3ubuntu0.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-103658.json"