Loading vulnerability…
Out-of-bounds read in GNU Aspell dictionary loading
GNU Aspell before version 0.60.8.3 contains an out-of-bounds read vulnerability in ReadOnlyDict::load(). When loading a binary read-only dictionary, the function uses header-supplied offsets as byte indices into a heap buffer without validating their bounds. A user who loads an attacker-crafted dictionary can trigger reads outside the allocated buffer, potentially disclosing heap memory or crashing the application. Distribution packages incorporating the fix are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose heap memory from the Aspell process or cause an application crash, resulting in denial of service. No integrity impact or arbitrary code execution is established for this vulnerability.
If you can’t patch tonight, do this now.
Until a patched build is deployed, load only trusted binary dictionaries. Avoid attacker-supplied dictionary files and prevent untrusted parties from controlling dictionary selection through --master, --dict-dir, or configuration options.
Patch, then assume compromise.
Apply upstream commit 941953b25031bc9104e83f58e138a664b8dedc3f or upgrade to GNU Aspell 0.60.8.3 when available. Alternatively, install a distribution package containing the backported fix. Amazon Linux 2 updates are available through ALAS2-2026-4022, with fixed Aspell packages starting at 0.60.6.1-22; Amazon Linux 2023 updates are provided through ALAS2023-2026-3275. Echo installations should update Aspell and related packages to 0.60.8.1-4+e1 or later. Fix availability varies by distribution.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.