CVE-2026-75819: Aspell 0 to before 0.60.8.3

Affected technology

Aspell · 0 to before 0.60.8.3
GNU

Component: ReadOnlyDict::load()
File: readonly_ws.cpp

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Active user interaction

What an attacker can do

An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash. Vendor/CNA’s CVSS 4.0 assessment (base score 1.8/10) rates confidentiality and integrity impact as none; availability impact as low.