GNU Aspell versions through 0.60.8.2 contain a heap-based buffer overflow in the read‑only dictionary loader. The vulnerability is rooted in String::reserve() calculating a capacity check with a signed int, which permits a large requested size to wrap negative, leaving the buffer undersized. A malicious .rws dictionary header with an oversized length field causes the parser to write beyond the allocated heap region, corrupting heap memory. The overflow can result in denial of service and, because of the unvalidated write, the potential for arbitrary code execution.

All installations of GNU Aspell up to and including version 0.60.8.2, regardless of operating system, are susceptible. The issue manifests when the application loads a .rws dictionary file, typically via commands such as aspell dump master <file> or through any process that automatically loads dictionaries.

The CVSS score of 5.9 indicates medium severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS data are unavailable. The attack requires an attacker to supply a crafted .rws file and convince a user or an application to load it; therefore the incident is primarily a local exploitation scenario. However, if a system or service uses Aspell to process untrusted input, the risk escalates, providing a path to denial of service or potential code execution. The vulnerability remains exploitable until patched with the release of 0.60.8.3.