ALAS2023-2026-3275

References: CVE-2026-103658  CVE-2026-75818  CVE-2026-75819  CVE-2026-75820 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to process a specially crafted dictionary file. This issue occurs due to an integer calculation error during buffer capacity checks in the read-only dictionary loader, leading to a heap-based buffer overflow. (CVE-2026-103658)

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.

This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3. (CVE-2026-75818)

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.

This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3. (CVE-2026-75819)

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.

This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3. (CVE-2026-75820)

Issue Correction:
Run dnf update aspell --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3275 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    aspell-debuginfo-0.60.8-7.amzn2023.0.3.aarch64
    aspell-devel-0.60.8-7.amzn2023.0.3.aarch64
    aspell-debugsource-0.60.8-7.amzn2023.0.3.aarch64
    aspell-0.60.8-7.amzn2023.0.3.aarch64

src:
    aspell-0.60.8-7.amzn2023.0.3.src

x86_64:
    aspell-debuginfo-0.60.8-7.amzn2023.0.3.x86_64
    aspell-debugsource-0.60.8-7.amzn2023.0.3.x86_64
    aspell-0.60.8-7.amzn2023.0.3.x86_64
    aspell-devel-0.60.8-7.amzn2023.0.3.x86_64