CVE-2026-103658

A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to process a specially crafted dictionary file. This issue occurs due to an integer calculation error during buffer capacity checks in the read-only dictionary loader, leading to a heap-based buffer overflow.

This vulnerability is rated as Important severity for Red Hat because memory corruption can result in arbitrary execution of code or application crashes with the privileges of the running user. In Red Hat Enterprise Linux environments, Aspell functions as a spell-checking CLI utility and shared library typically invoked by text editors or desktop software. Exploitation requires an attacker to convince a user to process an untrusted compiled dictionary file, precluding direct remote compromise and limiting the blast radius to the executing user's context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.