Aspell Security Update — AlmaLinux 8 (ALSA-2026:92615)

ALSA-2026:92615 updates GNU Aspell on AlmaLinux 8, fixing CVE-2026-103658 — arbitrary code execution via a crafted dictionary file (CWE-122 heap/stack overflow class), rated CVSS 5.9. Update with dnf update aspell on servers where aspell is installed.

High 5.9 CVSS 2026-10-30

AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

A crafted dictionary file executes code with the privileges of the process loading it — mail servers running aspell for spell-checking parsed content are the classic exposure path.

Type:

security

Severity:

important

Release date:

2026-10-30

Description:

GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.

Security Fix(es):

* aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	aspell-devel-0.60.6.1-23.el8_10.aarch64.rpm	4431a54f73c05cff75f6dc20e77fcdd45d9c9e730ebc0d0b79f849e24bf6a92f
aarch64	aspell-0.60.6.1-23.el8_10.aarch64.rpm	a9c15613797e1fc4ac8a4be2d8d3bcd032beaaaabbbe6994e100ca94a3c27535
i686	aspell-devel-0.60.6.1-23.el8_10.i686.rpm	5a6e3e22bf692cc610ec2e05e42eb39e0d1d9b87c7fc30909fb1959a146e41a8
i686	aspell-0.60.6.1-23.el8_10.i686.rpm	b499a4e42f7b7e582dd03cf77515a915caec92deb69cd1bd5cc4e31dc0309e00
ppc64le	aspell-0.60.6.1-23.el8_10.ppc64le.rpm	10e5456fed36cf1b8f44f4e84d57d03298545ca9bcc78a7579995c21b8b42ba9
ppc64le	aspell-devel-0.60.6.1-23.el8_10.ppc64le.rpm	6b306078782c17a4cb693da92fd98bcd886bae84a9ce9a358f399baec723f22c
s390x	aspell-0.60.6.1-23.el8_10.s390x.rpm	41f88c9c24a3941cecf1eb148eab3f1142aebe6d2dea2262f669b012b22ea876
s390x	aspell-devel-0.60.6.1-23.el8_10.s390x.rpm	7e5bef2089ff3e69debdfb43c2b6beaeee324987722d14d91566841b2f381d8f
x86_64	aspell-devel-0.60.6.1-23.el8_10.x86_64.rpm	36339fa2a90642e98ab65f712e99695e6129b7946bae560ceed3ce81c158c5dc
x86_64	aspell-0.60.6.1-23.el8_10.x86_64.rpm	5e8adb0da209403ef51660edf5941d0298cf458a427a6d83ec2590e43dfb5c80

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is CVE-2026-103658?

It is an arbitrary code execution vulnerability in GNU Aspell triggered by a crafted dictionary file, classified CWE-122 (buffer overflow), rated CVSS 5.9 and fixed in the AlmaLinux 8 update ALSA-2026:92615.

Who is affected?

Systems with aspell installed where dictionary files can be influenced — mail servers using aspell for spell-checking (the dictionary is loaded per-user/per-language) are the standard exposure.

How do I apply the fix?

Run dnf update aspell and restart services that invoke it (mail server spell-check modules, webmail spell-check).

Is a spell checker a real risk?

When it parses attacker-influenced files, yes — aspell historically has had exploitable dictionary-parsing bugs, and mail servers load dictionaries in the context of processing untrusted mail. Low urgency, but it belongs in the patch batch.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen