GNU Aspell EUVD-2026-93364

Exploitation requires an attacker to supply a specially crafted prezip-compressed file AND to induce a local user to process that file with the prezip-bin decompressor (prog/prezip.c) - this is the explicit prerequisite (UI:A/AV:L). Limiting factors: the attack is local only (no network vector), depends on user interaction (the victim must actively run prezip-bin on the malicious file), and is rated high attack complexity (AC:H), reflecting that reliably triggering the out-of-bounds condition is non-trivial. No authentication is required (PR:N), but the practical reach is confined to systems where users manually process untrusted compressed dictionary data with prezip-bin. Affected versions are those prior to 0.60.8.3.

This is a genuinely low-priority issue, and multiple signals agree. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L) and the resulting 1.8 base score both point to a local-only, user-interaction-dependent, high-complexity bug whose only concrete impact is a process crash (availability). There is no confidentiality or integrity impact to the vulnerable system itself. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so there is no exploitation-based signal that would elevate it above the low technical score. One point of tension worth flagging: although CWE-122 (heap-based buffer overflow) with out-of-bounds write can in principle escalate to code execution, both the vendor description and the CVSS impact metrics characterize the outcome only as a crash, so the realistic risk is denial-of-service of a command-line tool, not RCE. The input vector's subsequent-system metrics (SC:L/SI:L) are hard to justify for a local file-processing crash and appear generous; I have set them to N in my own assessment. Bottom line: real-world risk is minimal - exploitation requires a local user to be tricked into feeding a crafted file to prezip-bin, and the payoff is a crashed utility.

An attacker crafts a malicious prezip-compressed file and convinces a local user (e.g., via a downloaded dictionary package or email attachment) to process it with prezip-bin. When the decompressor fails to validate buffer space, the crafted input triggers an out-of-bounds heap read/write, corrupting memory and crashing the process. No public exploit code is referenced, and the documented impact is a crash rather than confirmed code execution.