GNU Aspell has an integer truncation flaw in the WritableDict::add() routine, where word lengths are stored in a single byte when loading a personal wordlist. Words whose length is a multiple of 256 become truncated, corrupting heap data. An attacker can exploit this by making a user run aspell with a crafted personal wordlist containing such a word, triggering the heap corruption and crashing the program. The result is an application crash—Denial of Service—without any escalation of privileges or exposure of confidential data.

The affected product is GNU Aspell, a spell‑checking utility. All releases of Aspell prior to 0.60.8.3 are vulnerable. The fix was introduced in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and will appear in the 0.60.8.3 update. Systems that still run earlier versions and load personal wordlists are in scope.

The CVSS score of 1.8 and the lack of an EPSS entry indicate a low severity and low likelihood of widespread exploitation. The vulnerability is local; an attacker must convince a user to run aspell with a maliciously crafted personal wordlist, which typically requires social engineering or compromising the local machine. Because the impact is limited to causing the aspell process to crash, the overall risk to confidentiality or integrity is minimal, though repeated crashes could disrupt user productivity. This vulnerability is not included in the CISA KEV catalog, further suggesting it is not actively exploited by threat actors.