ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-75820

Integer Truncation Leading to Heap Corruption in GNU Aspell

CVSS 4.0 1.8 LOWCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-75820

Published

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service. This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-75820

Published

Aspell

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GNU",
                    "product": "Aspell",
                    "repo": "https://github.com/GNUAspell/aspell",
                    "modules": [
                        "WritableDict::add()"
                    ],
                    "programFiles": [
                        "modules/speller/default/writable.cpp"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "0.60.8.3",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unknown"
                }

Original source record · Cite this exact observation · Complete original publisher JSON