GNU Aspell CVE-2026-103658

Exploitation requires the victim to load an attacker-supplied read-only dictionary (.rws) file whose header contains a valid endian marker (12345678) and an oversized 32-bit size field (e.g. lang_name_size = 0x7FFFFFFF) that drives the signed-int overflow in String::reserve(). The attacker must first get this crafted file to the victim and the victim must invoke Aspell on it - for example via 'aspell dump master <file>' - so there is no remote or network-service trigger. Limiting factors: local delivery of the file, required victim action to load the untrusted dictionary, and affected versions at or below 0.60.8.2 (fixed in 0.60.8.3); code execution is only 'potential' while denial of service is the reliable impact.

This is a moderate, not high, real-world priority. The input CVSS base score is 5.9 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N) with low confidentiality, integrity, and availability impact, reflecting a local, file-borne heap-overflow rather than a remotely reachable flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The most important signal conflict is within the CVSS vector itself: it is marked AV:L with UI:N, yet the description explicitly states exploitation requires inducing a victim to load a malicious .rws dictionary (e.g. via 'aspell dump master <file>') - that is user interaction, so UI:N understates the limiting factor and likely inflates the perceived likelihood. The 'potentially code execution' language supports the RCE tag but is speculative; the confirmed, reliable outcome is heap corruption leading to denial of service. Net: a legitimate memory-safety bug worth patching promptly where Aspell processes untrusted dictionaries, but not an emergency given the local vector, required victim action, and absence of any exploitation evidence.

An attacker crafts a malicious read-only dictionary (.rws) file with a valid endian marker (12345678) and an oversized 32-bit length field such as lang_name_size = 0x7FFFFFFF, then tricks a victim into loading it (for example via 'aspell dump master <file>'). Because String::reserve() computes its capacity check as a signed int, the value wraps negative, the backing buffer is never grown, and attacker-controlled data is written past an undersized heap allocation, corrupting memory. No public exploit code was identified at time of analysis; the reliable outcome is a crash/denial of service with potential for code execution.