GNU Aspell CVE-2026-75819

Exploitation requires that the victim invoke aspell against an attacker-supplied binary .rws dictionary file, supplied specifically through the --master option, the --dict-dir option, or an equivalent configuration setting that points dictionary loading at the crafted file. The trigger is ReadOnlyDict::load() in readonly_ws.cpp treating header offset fields as byte indices into a heap buffer without bounds validation. Limiting factors: the vector is local (AV:L) with no network exposure, attack complexity is high (AC:H) because the malicious offsets must be shaped against the heap layout, and active user interaction is mandatory (UI:A) - the user must deliberately run aspell with the malicious dictionary path. No elevated privileges are needed (PR:N), but the social-engineering/file-delivery requirement substantially constrains real-world exploitability. Impact is confined to limited heap memory disclosure and process crash; no code execution or integrity impact.

This is a low-priority vulnerability by every available signal, and the signals are consistent rather than conflicting. The provided CVSS 4.0 vector (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N, score 1.8) describes a local-vector, high-complexity flaw that requires active user interaction and yields only limited impact (application crash / limited memory disclosure). There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of exploitation pressure to contradict the low base score. The core limiting factor is the delivery model: the attacker does not reach the victim over a network but must first get a user to run aspell against an attacker-controlled binary .rws dictionary file. The realistic worst case is heap memory disclosure (potential leak of adjacent heap contents) or a denial of service via crash of the aspell process - not code execution, as CWE-125 (out-of-bounds read) and the vector's VI:N/VA:L (no integrity impact) confirm. One minor data caveat: the two provided references point to cert.pl (with a URL path referencing the neighboring ID CVE-2026-75818) and the generic aspell.net homepage, neither of which is a direct advisory for this exact ID - the authoritative source is the vendor fix commit. Overall this is a genuinely low-risk, high-CVSS-it-is-not issue; prioritize via routine patching, not emergency response.

An attacker crafts a malicious binary .rws dictionary whose header offset fields point outside the allocated heap buffer, then convinces a victim (via phishing, a malicious repo, or a shared dictionary) to run aspell with that file through --master, --dict-dir, or a configuration option. When ReadOnlyDict::load() uses the unvalidated offsets as indices, the process reads out of bounds, disclosing adjacent heap memory or crashing. No public exploit code has been identified, and success depends on the user actively invoking aspell against the crafted file.