Back to Security Advisories

Aspell Security Update — AlmaLinux 8 (ALSA-2026:92615)

ALSA-2026:92615 updates GNU Aspell on AlmaLinux 8, fixing CVE-2026-103658 — arbitrary code execution via a crafted dictionary file (CWE-122 heap/stack overflow class), rated CVSS 5.9. Update with dnf update aspell on servers where aspell is installed.

High 5.9 CVSS
AlmaLinux 8

What this means under a SharedLicense license

A crafted dictionary file executes code with the privileges of the process loading it — mail servers running aspell for spell-checking parsed content are the classic exposure path.

Type:

security

Severity:

important

Release date:

2026-10-30

Description:

GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.

Security Fix(es):

* aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 aspell-devel-0.60.6.1-23.el8_10.aarch64.rpm 4431a54f73c05cff75f6dc20e77fcdd45d9c9e730ebc0d0b79f849e24bf6a92f
aarch64 aspell-0.60.6.1-23.el8_10.aarch64.rpm a9c15613797e1fc4ac8a4be2d8d3bcd032beaaaabbbe6994e100ca94a3c27535
i686 aspell-devel-0.60.6.1-23.el8_10.i686.rpm 5a6e3e22bf692cc610ec2e05e42eb39e0d1d9b87c7fc30909fb1959a146e41a8
i686 aspell-0.60.6.1-23.el8_10.i686.rpm b499a4e42f7b7e582dd03cf77515a915caec92deb69cd1bd5cc4e31dc0309e00
ppc64le aspell-0.60.6.1-23.el8_10.ppc64le.rpm 10e5456fed36cf1b8f44f4e84d57d03298545ca9bcc78a7579995c21b8b42ba9
ppc64le aspell-devel-0.60.6.1-23.el8_10.ppc64le.rpm 6b306078782c17a4cb693da92fd98bcd886bae84a9ce9a358f399baec723f22c
s390x aspell-0.60.6.1-23.el8_10.s390x.rpm 41f88c9c24a3941cecf1eb148eab3f1142aebe6d2dea2262f669b012b22ea876
s390x aspell-devel-0.60.6.1-23.el8_10.s390x.rpm 7e5bef2089ff3e69debdfb43c2b6beaeee324987722d14d91566841b2f381d8f
x86_64 aspell-devel-0.60.6.1-23.el8_10.x86_64.rpm 36339fa2a90642e98ab65f712e99695e6129b7946bae560ceed3ce81c158c5dc
x86_64 aspell-0.60.6.1-23.el8_10.x86_64.rpm 5e8adb0da209403ef51660edf5941d0298cf458a427a6d83ec2590e43dfb5c80

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-103658?
It is an arbitrary code execution vulnerability in GNU Aspell triggered by a crafted dictionary file, classified CWE-122 (buffer overflow), rated CVSS 5.9 and fixed in the AlmaLinux 8 update ALSA-2026:92615.
Who is affected?
Systems with aspell installed where dictionary files can be influenced — mail servers using aspell for spell-checking (the dictionary is loaded per-user/per-language) are the standard exposure.
How do I apply the fix?
Run dnf update aspell and restart services that invoke it (mail server spell-check modules, webmail spell-check).
Is a spell checker a real risk?
When it parses attacker-influenced files, yes — aspell historically has had exploitable dictionary-parsing bugs, and mail servers load dictionaries in the context of processing untrusted mail. Low urgency, but it belongs in the patch batch.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System