Linux · Amazon Linux · Security advisory · November 7, 2026

ALAS2023-2026-3275: Security update for 4 packages

ALAS2023-2026-3275, released November 7, 2026, fixes 4 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Highest CVSS
7.8
Base score, 0 to 10
Highest EPSS
0.0021
11th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 1 Routine 3

Fixed package versions

ProductReleaseFixed in
aspellamzn 202312:0.60.8-7.amzn2023.0.3
aspell-debuginfoamzn 202312:0.60.8-7.amzn2023.0.3
aspell-debugsourceamzn 202312:0.60.8-7.amzn2023.0.3
aspell-develamzn 202312:0.60.8-7.amzn2023.0.3

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-103658 GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.7.8 0.0021 None reported
Routine CVE-2026-75818 Heap Buffer Overflow in GNU Aspell's prezip utilityn/a 0.0015 None reported
Routine CVE-2026-75820 Integer Truncation Leading to Heap Corruption in GNU Aspelln/a 0.0013 None reported
Routine CVE-2026-75819 Out-of-bounds Read in GNU Aspelln/a 0.0013 None reported
Showing 1 to 4 of 4 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.