{"schemaVersion":3,"id":"CVE-2026-75820","aliases":["UBUNTU-CVE-2026-75820","DEBIAN-CVE-2026-75820"],"status":"published","duplicateOf":null,"title":null,"description":"GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.\n\n\n\nThis issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.","dates":{"published":"2026-10-06T10:57:59.621Z","modified":"2026-10-06T12:49:39.265Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":1.8,"severity":"low","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":1.8,"severity":"low","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":1.8,"severity":"low","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":1.8,"severity":"low","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":1.8,"severity":"low","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00125,"percentile":0.02036,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-07T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00125,"percentile":0.02036}],"last30":[{"date":"2026-10-07T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00125,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00125,"percentile":0.02036}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"debian","product":"aspell","name":"aspell","label":"aspell","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/aspell","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"aspell","name":"aspell","label":"aspell","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/aspell","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"gnu","product":"aspell","name":"Aspell","label":"aspell","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.60.8.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.60.8.3","eol":null,"hubHref":"/vendor/gnu/aspell"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-75818","label":"cert.pl/en/posts/2026/10/CVE-2026-75818","hostname":"cert.pl","tags":["Third Party Advisory","REPORT"]},{"url":"http://aspell.net/","label":"aspell.net","hostname":"aspell.net","tags":["Product"]},{"url":"https://ubuntu.com/security/CVE-2026-75820","label":"ubuntu.com/security/CVE-2026-75820","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75820","label":"www.cve.org/CVERecord?id=CVE-2026-75820","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75820","label":"security-tracker.debian.org/tracker/CVE-2026-75820","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:12079-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:12079-1"]},"timeline":[{"kind":"published","date":"2026-10-06T10:57:59.621Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-06T12:49:39.265Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":7,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:03:59.652Z","stale":false,"partial":false}}