Loading vulnerability…
Heap-based buffer overflow in GNU Aspell prezip-bin
CVE-2026-75818 is a heap-based buffer overflow in the prezip-bin decompressor in GNU Aspell versions before 0.60.8.3. Insufficient checks of available buffer space allow a specially crafted compressed file to trigger out-of-bounds heap reads and writes. Processing the malicious input can corrupt heap memory and crash the decompressor.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause memory corruption and terminate the affected process, resulting in denial of service. Arbitrary code execution and disclosure of heap contents have not been established for this vulnerability.
If you can’t patch tonight, do this now.
Until a fixed build is installed, avoid processing untrusted compressed files with prezip-bin. No vendor-provided workaround is specified.
Patch, then assume compromise.
Apply upstream fix commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f, install a distribution package containing the backported fix, or upgrade to GNU Aspell 0.60.8.3 when available. For Amazon Linux 2, install Aspell 0.60.6.1-22 or later using 'yum update aspell' or 'yum update --advisory ALAS2-2026-4022'. Amazon Linux 2023 packages are addressed by advisory ALAS2023-2026-3275. Distribution patch availability varies.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.