CVE-2026-75818
Heap Buffer Overflow in GNU Aspell's prezip utility
- State
- Published
- Severity
- 1.8 Low
- Published
- Oct 6, 2026
- Updated
- Oct 6, 2026
- Reserved
- Aug 18, 2026
Description
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.
This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 1.8 Low | CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N | CERT-PL |
Weaknesses
- CWE-122 Heap-based buffer overflow
Affected Products
| Product | Versions |
|---|---|
AspellGNU |
|
References
- https://cert.pl/en/posts/2026/10/CVE-2026-75818third-party-advisory
- http://aspell.net/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.