CVE-2026-75818

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75818", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-08-18T10:13:29.246Z", "datePublished": "2026-10-06T10:57:52.690Z", "dateUpdated": "2026-10-06T12:50:58.338Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-10-06T10:57:52.690Z"}, "title": "Heap Buffer Overflow in GNU Aspell's prezip utility", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "affected": [{"vendor": "GNU", "product": "Aspell", "repo": "https://github.com/GNUAspell/aspell", "modules": ["prezip"], "programFiles": ["prog/prezip.c"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.60.8.3", "versionType": "semver"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:aspell:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "0.60.8.2"}]}]}], "descriptions": [{"lang": "en", "value": "GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.\n\n\n\nThis issue was fixed in commit\u00a015b188437f9e0192d4ac4472ad66a4e2f62a782f which will be\u00a0released in version\u00a00.60.8.3.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.<br><div><br></div><div><span>This issue was fixed in commit&nbsp;</span>15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be&nbsp;<span>released in version&nbsp;</span><span>0.60.8.3.</span></div>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://cert.pl/en/posts/2026/10/CVE-2026-75818", "tags": ["third-party-advisory"]}, {"url": "http://aspell.net/", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.8, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T12:50:34.738213Z", "id": "CVE-2026-75818", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T12:50:58.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-75818", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T12:50:34.738213Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T12:50:43.403Z"}}], "cna": {"tags": ["x_open-source"], "title": "Heap Buffer Overflow in GNU Aspell's prezip utility", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/GNUAspell/aspell", "vendor": "GNU", "modules": ["prezip"], "product": "Aspell", "versions": [{"status": "affected", "version": "0", "lessThan": "0.60.8.3", "versionType": "semver"}], "programFiles": ["prog/prezip.c"], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/en/posts/2026/10/CVE-2026-75818", "tags": ["third-party-advisory"]}, {"url": "http://aspell.net/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.\n\n\n\nThis issue was fixed in commit\u00a015b188437f9e0192d4ac4472ad66a4e2f62a782f which will be\u00a0released in version\u00a00.60.8.3.", "supportingMedia": [{"type": "text/html", "value": "GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.<br><div><br></div><div><span>This issue was fixed in commit&nbsp;</span>15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be&nbsp;<span>released in version&nbsp;</span><span>0.60.8.3.</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:aspell:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.60.8.2", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-10-06T10:57:52.690Z"}}}, "cveMetadata": {"cveId": "CVE-2026-75818", "state": "PUBLISHED", "dateUpdated": "2026-10-06T12:50:58.338Z", "dateReserved": "2026-08-18T10:13:29.246Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-10-06T10:57:52.690Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["prezip"], "product": "Aspell", "programFiles": ["prog/prezip.c"], "repo": "https://github.com/GNUAspell/aspell", "vendor": "GNU", "versions": [{"lessThan": "0.60.8.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.\n\n\n\nThis issue was fixed in commit\u00a015b188437f9e0192d4ac4472ad66a4e2f62a782f which will be\u00a0released in version\u00a00.60.8.3."}], "id": "CVE-2026-75818", "lastModified": "2026-10-06T15:03:59.427", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.8, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75818", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T12:50:34.738213Z", "version": "2.0.3"}}]}, "published": "2026-10-06T11:17:29.730", "references": [{"source": "cvd@cert.pl", "url": "http://aspell.net/"}, {"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/10/CVE-2026-75818"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{"bugzilla": {"description": "aspell: aspell: Denial of Service via crafted compressed file in prezip-bin", "id": "2546566", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546566"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in GNU Aspell's prezip-bin utility. The decompression component does not properly validate buffer space when decompressing input files. An attacker could convince a user to process a specially crafted compressed file, triggering out-of-bounds memory operations that cause memory corruption and a Denial of Service (DoS) through an application crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-75818", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "aspell", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "aspell", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "aspell", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "aspell", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "aspell", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-06T10:57:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-75818\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-75818\nhttp://aspell.net/\nhttps://cert.pl/en/posts/2026/10/CVE-2026-75818"], "statement": "This vulnerability is rated as Low impact for Red Hat products because successful exploitation requires local user interaction to process an untrusted file and is limited to causing an application crash. The prezip-bin utility is a short-lived command-line tool rather than a network daemon or persistent service. Under typical deployments, this tool is rarely invoked directly on untrusted inputs, preventing remote exploitation.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.60.8.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Aspell", "source": "cna", "vendor": "GNU"}, "product": "aspell", "vendor": "gnu"}], "created": "2026-10-06T14:45:18.428354+00:00", "updated": "2026-10-07T07:15:07.779446+00:00", "vendors": ["gnu", "gnu$PRODUCT$aspell"]}