GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash. This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3275 advisory.

    A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of     Service (DoS) by convincing a user to process a specially crafted dictionary file. This issue occurs due     to an integer calculation error during buffer capacity checks in the read-only dictionary loader, leading     to a heap-based buffer overflow. (CVE-2026-103658)

    GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in     prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can     cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a     malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.



    This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version     0.60.8.3. (CVE-2026-75818)

    GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When     loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a     heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run     aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options,     leading to heap memory disclosure or a denial of service via application crash.



    This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version     0.60.8.3. (CVE-2026-75819)

    GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in     modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a     single byte, causing truncation for words whose length is a multiple of 256. This leads to heap     corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal     wordlist containing such a word, resulting in denial of service.



    This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version     0.60.8.3. (CVE-2026-75820)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of aspell installed on the remote host is prior to 0.60.6.1-22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4022 advisory.

    A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of     Service (DoS) by convincing a user to process a specially crafted dictionary file. This issue occurs due     to an integer calculation error during buffer capacity checks in the read-only dictionary loader, leading     to a heap-based buffer overflow. (CVE-2026-103658)

    GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in     prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can     cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a     malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.



    This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version     0.60.8.3. (CVE-2026-75818)

    GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When     loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a     heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run     aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options,     leading to heap memory disclosure or a denial of service via application crash.



    This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version     0.60.8.3. (CVE-2026-75819)

    GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in     modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a     single byte, causing truncation for words whose length is a multiple of 256. This leads to heap     corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal     wordlist containing such a word, resulting in denial of service.



    This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version     0.60.8.3. (CVE-2026-75820)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When
    loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a
    heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run
    aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options,
    leading to heap memory disclosure or a denial of service via application crash. This issue was fixed in
    commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.
    (CVE-2026-75819)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When     loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a     heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run     aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options,     leading to heap memory disclosure or a denial of service via application crash. This issue was fixed in     commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.
    (CVE-2026-75819)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371903	Amazon Linux 2023 : aspell, aspell-devel (ALAS2023-2026-3275)	Nessus	Amazon Linux Local Security Checks	Local	low
371763	Amazon Linux 2 : aspell (ALAS-2026-4022)	Nessus	Amazon Linux Local Security Checks	Local	low
474849	Echo: aspell: security update to 0.60.8.1-4+e1	Tenable Cloud Security	Echo Local Security Checks	Local	low
474849	Echo: aspell: security update to 0.60.8.1-4+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
363225	Linux Distros Unpatched Vulnerability : CVE-2026-75819	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-75819

low

Tenable Plugins

low

low

low

low

low