GNU Aspell EUVD-2026-93366

Exploitation requires the victim to run aspell while loading an attacker-supplied personal wordlist (custom dictionary) that contains at least one word whose length is an exact multiple of 256 bytes, triggering the single-byte length truncation in WritableDict::add(). Limiting factors: the attack is local only (no network vector), requires active user interaction to load the malicious dictionary, has high attack complexity (the specific 256-multiple length condition must be met), and yields only a denial of service - no confidentiality or code-execution impact is established. There is no default-configuration remote exposure.

This is a genuinely low-priority issue, and the signals are consistent in saying so. The CVSS 4.0 base score of 1.8 reflects a local attack vector (AV:L), high attack complexity (AC:H), and - critically - required active user interaction (UI:A): the victim must be convinced to run aspell against an attacker-supplied personal wordlist. Although PR:N indicates no authentication, the UI:A requirement and local vector mean this is not remotely exploitable. The only impact is low availability (VA:L) plus low subsequent-system integrity (SI:L) - i.e. heap corruption leading to a crash/denial of service, not confirmed code execution. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The integer-truncation mechanism (CWE-190, length-is-a-multiple-of-256 edge case) is real and vendor-confirmed via the fixing commit, but the practical risk is minimal because an attacker must socially engineer a user into running a crafted dictionary locally. No signals conflict here - low CVSS, low real-world impact, and low exploitability all align. Treat as routine patching, not an emergency.

An attacker crafts a malicious personal wordlist containing a word whose length is an exact multiple of 256 bytes and tricks a user into loading it with aspell (e.g. distributing it as a shared custom dictionary). When WritableDict::add() truncates the stored length to a single byte, heap corruption occurs and the aspell process crashes, causing denial of service. No public exploit code was provided, and the high attack complexity plus required user interaction make this hard to weaponize.