Three GNU Aspell Flaws Allow Heap Corruption, Memory Disclosure and Denial of Service

CERT Polska disclosed three vulnerabilities affecting all GNU Aspell versions before 0.60.8.3. CVE-2026-75818 permits heap memory corruption when the prezip-bin utility decompresses a crafted file. CVE-2026-75819 can expose heap memory or crash an application when Aspell loads a malicious binary dictionary. CVE-2026-75820 causes heap corruption and denial of service when Aspell loads a crafted personal wordlist containing a word whose length is a multiple of 256.

Each attack requires convincing a user to process attacker-controlled input; the supplied reports do not establish active exploitation. CERT Polska coordinated disclosure, and Malware News relayed the advisory. Fixes have been committed for inclusion in version 0.60.8.3, but the reports do not confirm release availability. Organizations using Aspell should identify affected installations, avoid processing untrusted compressed files, dictionaries and personal wordlists, and deploy the fixed release or vendor-provided patches when available.