Hi,

The following vulnerability was published for aspell.

CVE-2026-103658[0]:
| GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains
| a heap-based buffer overflow write (CWE-122) in its read-only
| dictionary loader. String::reserve() in common/string.hpp computes
| its capacity check with a signed int ((int)s + 1), so a requested
| size of 0x7FFFFFFF wraps negative and the backing buffer is never
| grown. ReadOnlyDict::load() in
| modules/speller/default/readonly_ws.cpp passes the unvalidated
| 32-bit size fields from a .rws dictionary header into this path, so
| a crafted .rws file with a valid endian marker (12345678) and an
| oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes
| attacker-controlled data to be written out of bounds past an
| undersized heap allocation. An attacker who induces a victim to load
| a malicious dictionary — for example via aspell dump master <file> —
| can corrupt heap memory, resulting in denial of service and
| potentially code execution. Fixed in b830b6e and will be fixed in
| release 0.60.8.3.

https://github.com/GNUAspell/aspell/security/advisories/GHSA-p35p-2mw5-fj5j
https://github.com/GNUAspell/aspell/commit/b830b6e


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-103658
https://www.cve.org/CVERecord?id=CVE-2026-103658

Please adjust the affected versions in the BTS as needed.

Hi, Moritz

Thanks for the info. Sorry for not replying before, I am waiting for a
new upstream release and seems it is taking longer that expected.

Since priority is not RC I prefer to wait for that upstream release. Do you
think an upload to stable-security is convenient?

Regards,