Search: CVE-2026-75819

GNU Aspell contains an out-of-bounds read vulnerability in the ReadOnlyDict::load() function within readonly_ws.cpp. This occurs when loading a binary .rws dictionary file, where offset fields from the file header are used as byte indices into a heap buffer without proper bounds validation. An attacker can exploit this by supplying a crafted dictionary file via --master, --dict-dir, or configuration options, potentially causing heap memory disclosure or a denial of service through application crash. This vulnerability is fixed in version 0.60.8.3.