Loading vulnerability…
Integer Truncation in GNU Aspell Personal Wordlist Loading
CVE-2026-75820 is an integer truncation vulnerability in GNU Aspell's WritableDict::add() function affecting versions before 0.60.8.3 without the fix. When loading a personal wordlist, Aspell stores word lengths in a single byte. A crafted word whose length is a multiple of 256 causes length truncation and subsequent heap corruption. Exploitation requires convincing a user to run Aspell with the malicious personal wordlist and can result in denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a crafted personal wordlist can corrupt heap memory and crash the Aspell process, disrupting spell-checking operations. Arbitrary code execution and sensitive-information disclosure have not been established for this vulnerability.
If you can’t patch tonight, do this now.
Until a fixed build is installed, avoid loading personal wordlists from untrusted sources and restrict modification of wordlists used by Aspell. These measures reduce exposure to attacker-controlled input; no specific vendor workaround is documented.
Patch, then assume compromise.
Apply upstream fix commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d or install a distribution package containing the backported fix. The upstream fix is scheduled for GNU Aspell 0.60.8.3; upgrade to that version or a later fixed release when available. On Amazon Linux 2, update Aspell to 0.60.6.1-22 or later using 'yum update aspell' or 'yum update --advisory ALAS2-2026-4022'.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.