CVE-2026-75820 Integer Truncation Leading to Heap Corruption in GNU Aspell
An attacker can cause denial of service in GNU Aspell by tricking a user into loading a crafted personal wordlist, triggering heap corruption via integer truncation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-75820?
CVE-2026-75820 is a low-severity vulnerability in GNU Aspell, published on 6 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.
This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.
Weakness: CWE-190
Which versions are affected by CVE-2026-75820?
How do I fix CVE-2026-75820?
Upgrade to a fixed version.
Is CVE-2026-75820 being exploited?
There is no known exploitation of CVE-2026-75820 in the wild and no public exploit code.
Sources
Also known as AZL-105966, BELL-CVE-2026-75820, DEBIAN-CVE-2026-75820, ECHO-942f-3e07-cfce, GHSA-7gjr-5wh9-g7w9, UBUNTU-CVE-2026-75820.