CVE-2026-103658: GNU Aspell heap buffer overflow in dictionary loader

CVE-2026-103658 · Severity: medium · CVSS 5.9 · Published 2026-10-12

GNU Aspell is a spell-checking library used in word processors and text editors. A malicious dictionary file (.rws) can trigger a heap buffer overflow when loaded, allowing an attacker to corrupt memory and potentially execute arbitrary code or crash the application. An attacker can deliver the malicious dictionary via email, file sharing, or by inducing a user to load it through the aspell command-line tool.

Technologies: Gnu Aspell. Vendors: Gnu.

Quick answers

Is CVE-2026-103658 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-103658 being exploited in the wild.
How severe is CVE-2026-103658?
Medium severity, with a CVSS score of 5.9, published 12 October 2026.
Which products and versions are affected?
Gnu Aspell 0.60.8.2 and earlier (vulnerable code present in 0.60.8, 0.60.8.1).
Is there a fix for CVE-2026-103658?
Yes: fixed in 0.60.8.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103658 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-103658?
Check whether you run Gnu Aspell at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.60.8.3

Technical details

A signed integer wrap in String::reserve() (common/string.hpp line 78) causes a capacity check to fail when a requested size of 0x7FFFFFFF is passed. ReadOnlyDict::load() in readonly_ws.cpp passes unvalidated 32-bit size fields from a crafted .rws dictionary header directly into String::reserve(), triggering the bug. The subsequent file read operation writes approximately 3476 attacker-controlled bytes past a 64-byte heap allocation, resulting in heap corruption. A fix exists in commit b830b6e and will be released in version 0.60.8.3.

Affected products

  • GNU Aspell 0.60.8.2 and earlier (vulnerable code present in 0.60.8, 0.60.8.1)

Timeline

  • 2026-10-06: disclosed
  • 2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.