Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by CERT-PL

CVE-2026-75818Heap Buffer Overflow in GNU Aspell's prezip utility

Low 1.8

In plain English

A low-severity heap buffer overflow in Aspell from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)1.8Low
Exploit odds (30 days)0.1%top 96.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash. This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12aspellno fix listedDEBIAN-CVE-2026-75818
Debian:13aspellno fix listedDEBIAN-CVE-2026-75818
Debian:14aspell0.60.8.2-4DEBIAN-CVE-2026-75818
Ubuntu:22.04:LTSaspellno fix listedUBUNTU-CVE-2026-75818
Ubuntu:24.04:LTSaspellno fix listedUBUNTU-CVE-2026-75818
Ubuntu:26.04:LTSaspellno fix listedUBUNTU-CVE-2026-75818
Ubuntu:26.10aspellno fix listedUBUNTU-CVE-2026-75818

Affected products (as reported)

VendorProductVersions
GNU Aspell 0 – before 0.60.8.3

Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N

References