Aspell
Monthly
Loading an attacker-supplied read-only dictionary (.rws) file in GNU Aspell through 0.60.8.2 can corrupt heap memory, yielding reliable denial of service and potentially code execution. The root cause is a heap-based buffer overflow write (CWE-122) triggered by a signed-integer overflow in String::reserve(), which lets a crafted 32-bit length field in the .rws header (for example lang_name_size = 0x7FFFFFFF, paired with the valid endian marker 12345678) bypass the capacity check so attacker-controlled data is written past an undersized allocation. Exploitation is local in nature - there is no network-service trigger - and requires the victim to actively load the malicious dictionary, such as by running 'aspell dump master <file>'; no public exploit code was identified and there is no confirmed active exploitation at time of analysis, so this is assessed as a moderate-priority issue despite the RCE tag.
Heap corruption in GNU Aspell's personal-wordlist handling lets a local attacker crash a user's spell-checking session by supplying a crafted dictionary file. All Aspell releases before 0.60.8.3 are affected: when a wordlist containing a word whose length is an exact multiple of 256 bytes is loaded, WritableDict::add() in modules/speller/default/writable.cpp stores the word length in a single byte, truncating it and corrupting heap memory, which results in denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor fix was published as commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and is slated for release in version 0.60.8.3. With a CVSS 4.0 base score of 1.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, this is a genuinely low-priority issue: the attack is local-only, needs the victim to actively load an attacker-supplied dictionary, requires the specific multiple-of-256 length condition, and yields availability loss only.
Heap out-of-bounds read in GNU Aspell's binary dictionary loader (ReadOnlyDict::load() in readonly_ws.cpp) lets a crafted .rws dictionary file trigger limited heap memory disclosure or a crash of the aspell process. The victim must deliberately run aspell against the attacker-supplied dictionary via --master, --dict-dir, or an equivalent configuration setting, so the vector is local, high-complexity and dependent on user interaction, and no privileges are required (PR:N). Impact is confined to limited information disclosure and denial of service with no code execution or integrity impact, and no public exploit has been identified at time of analysis.
GNU Aspell's prezip-bin decompressor suffers a heap-based buffer overflow (CWE-122) that lets a crafted prezip-compressed file corrupt heap memory and crash the process. The issue affects Aspell versions prior to 0.60.8.3 and is only reachable through a local chain: an attacker must deliver a malicious compressed file and then persuade a user to run prezip-bin against it, so no privileges are required (PR:N) but user interaction and high attack complexity apply. The assessed impact is availability-only (VC:N/VI:N/VA:L) with a low CVSS 4.0 base score of 1.8 and an equivalent CVSS 3.1 assessment of AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Multiple signals - trivial score, local-only vector, interaction requirement and crash-only outcome - converge on a genuinely low-priority issue.
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Loading an attacker-supplied read-only dictionary (.rws) file in GNU Aspell through 0.60.8.2 can corrupt heap memory, yielding reliable denial of service and potentially code execution. The root cause is a heap-based buffer overflow write (CWE-122) triggered by a signed-integer overflow in String::reserve(), which lets a crafted 32-bit length field in the .rws header (for example lang_name_size = 0x7FFFFFFF, paired with the valid endian marker 12345678) bypass the capacity check so attacker-controlled data is written past an undersized allocation. Exploitation is local in nature - there is no network-service trigger - and requires the victim to actively load the malicious dictionary, such as by running 'aspell dump master <file>'; no public exploit code was identified and there is no confirmed active exploitation at time of analysis, so this is assessed as a moderate-priority issue despite the RCE tag.
Heap corruption in GNU Aspell's personal-wordlist handling lets a local attacker crash a user's spell-checking session by supplying a crafted dictionary file. All Aspell releases before 0.60.8.3 are affected: when a wordlist containing a word whose length is an exact multiple of 256 bytes is loaded, WritableDict::add() in modules/speller/default/writable.cpp stores the word length in a single byte, truncating it and corrupting heap memory, which results in denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor fix was published as commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and is slated for release in version 0.60.8.3. With a CVSS 4.0 base score of 1.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, this is a genuinely low-priority issue: the attack is local-only, needs the victim to actively load an attacker-supplied dictionary, requires the specific multiple-of-256 length condition, and yields availability loss only.
Heap out-of-bounds read in GNU Aspell's binary dictionary loader (ReadOnlyDict::load() in readonly_ws.cpp) lets a crafted .rws dictionary file trigger limited heap memory disclosure or a crash of the aspell process. The victim must deliberately run aspell against the attacker-supplied dictionary via --master, --dict-dir, or an equivalent configuration setting, so the vector is local, high-complexity and dependent on user interaction, and no privileges are required (PR:N). Impact is confined to limited information disclosure and denial of service with no code execution or integrity impact, and no public exploit has been identified at time of analysis.
GNU Aspell's prezip-bin decompressor suffers a heap-based buffer overflow (CWE-122) that lets a crafted prezip-compressed file corrupt heap memory and crash the process. The issue affects Aspell versions prior to 0.60.8.3 and is only reachable through a local chain: an attacker must deliver a malicious compressed file and then persuade a user to run prezip-bin against it, so no privileges are required (PR:N) but user interaction and high attack complexity apply. The assessed impact is availability-only (VC:N/VI:N/VA:L) with a low CVSS 4.0 base score of 1.8 and an equivalent CVSS 3.1 assessment of AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Multiple signals - trivial score, local-only vector, interaction requirement and crash-only outcome - converge on a genuinely low-priority issue.
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.