ALAS2-2026-4022

References: CVE-2026-103658  CVE-2026-75818  CVE-2026-75819  CVE-2026-75820 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to process a specially crafted dictionary file. This issue occurs due to an integer calculation error during buffer capacity checks in the read-only dictionary loader, leading to a heap-based buffer overflow. (CVE-2026-103658)

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.

This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3. (CVE-2026-75818)

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.

This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3. (CVE-2026-75819)

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.

This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3. (CVE-2026-75820)

Issue Correction:
Run yum update aspell or yum update --advisory ALAS2-2026-4022 to update your system.

New Packages:

aarch64:
    aspell-0.60.6.1-22.amzn2.0.1.aarch64
    aspell-devel-0.60.6.1-22.amzn2.0.1.aarch64
    aspell-debuginfo-0.60.6.1-22.amzn2.0.1.aarch64

i686:
    aspell-0.60.6.1-22.amzn2.0.1.i686
    aspell-devel-0.60.6.1-22.amzn2.0.1.i686
    aspell-debuginfo-0.60.6.1-22.amzn2.0.1.i686

src:
    aspell-0.60.6.1-22.amzn2.0.1.src

x86_64:
    aspell-0.60.6.1-22.amzn2.0.1.x86_64
    aspell-devel-0.60.6.1-22.amzn2.0.1.x86_64
    aspell-debuginfo-0.60.6.1-22.amzn2.0.1.x86_64