Heap-based Buffer Overflow in GNU Aspell's Decompressor
CVE-2026-75818

1.8LOW

Key Information:

Vendor

Gnu
Status
Aspell
Vendor
CVE Published:
6 October 2026

What is CVE-2026-75818?

GNU Aspell's prezip-bin suffers from a heap-based buffer overflow vulnerability due to inadequate buffer space checks in its decompressor component. This flaw can be exploited when a user processes a specially crafted compressed file, leading to out-of-bounds read and write operations. Such actions may ultimately result in memory corruption and crashing of the process. The vulnerability has been addressed in the version 0.60.8.3 update, making it critical for users to upgrade to this version or later to safeguard their systems.

Affected Version(s)

Aspell 0 < 0.60.8.3

References

https://cert.pl/en/posts/2026/10/CVE-2026-75818
third-party-advisory
http://aspell.net/
product

CVSS V4

Score:
1.8
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.