The vulnerability is an out-of-bounds read in the ReadOnlyDict::load() function of GNU Aspell. When a binary .rws dictionary file is loaded, the code uses offset values from the file header as byte indices into a heap buffer without bounds checking. This flaw is a classic read outside array bounds (CWE-125) and can leak heap memory contents or cause a crash, resulting in either a memory disclosure that may expose sensitive information or a denial of service through an application crash.

Affected systems are installations of GNU Aspell prior to version 0.60.8.3. Any user running older Aspell releases that load user-supplied .rws dictionaries via the --master, --dict-dir options or configuration files is at risk. The fix is included in commit 941953b25031bc9104e83f58e138a664b8dedc3f and will appear in the upcoming 0.60.8.3 release. This vulnerable code is present in all earlier releases.

The CVSS score of 1.8 indicates a low overall severity, and the EPSS data is not available; the vulnerability is not listed in the CISA KEV table. The likely attack vector requires an attacker to persuade a user to run aspell with a crafted .rws file. The exploit requires local user interaction and affords the attacker only limited information disclosure or a crash. While not highly attractive to remote adversaries, it can be used in a targeted social‑engineering or supply‑chain attack context.