GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.

alma_linux ALSA-2026:92615: ALSA-2026:92615: aspell security update (High)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2230:01 advisory.

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_92458 advisory.

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_92615 advisory.

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:92458 advisory.

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-92458 advisory.

    [12:0.60.8-9]
    - Backport fix for CVE-2026-103658

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92615 advisory.

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92458 advisory.

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-92615 advisory.

    [12:0.60.6.1-23]
    - Backport fix for CVE-2026-103658

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92615 advisory.

    GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or     as an independent spell checker.

    Security Fix(es):

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92458 advisory.

    GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or     as an independent spell checker.

    Security Fix(es):

    * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3275 advisory.

    A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of     Service (DoS) by convincing a user to process a specially crafted dictionary file. This issue occurs due     to an integer calculation error during buffer capacity checks in the read-only dictionary loader, leading     to a heap-based buffer overflow. (CVE-2026-103658)

    GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in     prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can     cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a     malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.



    This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version     0.60.8.3. (CVE-2026-75818)

    GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When     loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a     heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run     aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options,     leading to heap memory disclosure or a denial of service via application crash.



    This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version     0.60.8.3. (CVE-2026-75819)

    GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in     modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a     single byte, causing truncation for words whose length is a multiple of 256. This leads to heap     corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal     wordlist containing such a word, resulting in denial of service.



    This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version     0.60.8.3. (CVE-2026-75820)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of aspell installed on the remote host is prior to 0.60.6.1-22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4022 advisory.

    A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of     Service (DoS) by convincing a user to process a specially crafted dictionary file. This issue occurs due     to an integer calculation error during buffer capacity checks in the read-only dictionary loader, leading     to a heap-based buffer overflow. (CVE-2026-103658)

    GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in     prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can     cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a     malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.



    This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version     0.60.8.3. (CVE-2026-75818)

    GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When     loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a     heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run     aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options,     leading to heap memory disclosure or a denial of service via application crash.



    This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version     0.60.8.3. (CVE-2026-75819)

    GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in     modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a     single byte, causing truncation for words whose length is a multiple of 256. This leads to heap     corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal     wordlist containing such a word, resulting in denial of service.



    This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version     0.60.8.3. (CVE-2026-75820)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write     (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity     check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing     buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the     unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a     valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes     attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who     induces a victim to load a malicious dictionary  for example via aspell dump master <file>  can corrupt     heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be     fixed in release 0.60.8.3. (CVE-2026-103658)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write
    (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity
    check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing
    buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the
    unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a
    valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes
    attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who
    induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt
    heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be
    fixed in release 0.60.8.3. (CVE-2026-103658)

ID	Name	Product	Family	Type	Severity
375069	MiracleLinux 8 : aspell-0.60.6.1-23.el8_10 (AXSA:2026-2230:01)	Nessus	Miracle Linux Local Security Checks	Local	medium
374512	Rocky Linux 9 [CIQ] Security Update: aspell / aspell-debuginfo / aspell-debugsource / aspell-devel (crlsa-2026_92458)	Nessus	Rocky Linux Local Security Checks	Local	medium
374508	Rocky Linux 8 [CIQ] Security Update: aspell / aspell-debuginfo / aspell-debugsource / aspell-devel (crlsa-2026_92615)	Nessus	Rocky Linux Local Security Checks	Local	medium
374282	AlmaLinux 9 : aspell (ALSA-2026:92458)	Nessus	Alma Linux Local Security Checks	Local	medium
374270	Oracle Linux 9 : aspell (ELSA-2026-92458)	Nessus	Oracle Linux Local Security Checks	Local	medium
374193	RockyLinux 8 : aspell (RLSA-2026:92615)	Nessus	Rocky Linux Local Security Checks	Local	medium
374185	RockyLinux 9 : aspell (RLSA-2026:92458)	Nessus	Rocky Linux Local Security Checks	Local	medium
374085	Oracle Linux 8 : aspell (ELSA-2026-92615)	Nessus	Oracle Linux Local Security Checks	Local	medium
373994	RHEL 8 : aspell (RHSA-2026:92615)	Nessus	Red Hat Local Security Checks	Local	medium
373931	RHEL 9 : aspell (RHSA-2026:92458)	Nessus	Red Hat Local Security Checks	Local	medium
371903	Amazon Linux 2023 : aspell, aspell-devel (ALAS2023-2026-3275)	Nessus	Amazon Linux Local Security Checks	Local	low
371763	Amazon Linux 2 : aspell (ALAS-2026-4022)	Nessus	Amazon Linux Local Security Checks	Local	low
369208	Linux Distros Unpatched Vulnerability : CVE-2026-103658	Nessus	Misc.	Local	medium
474770	Echo: aspell: security update to 0.60.8.1-4+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474770	Echo: aspell: security update to 0.60.8.1-4+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-103658

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

low

medium

medium

medium