CVE-2026-75818

CVE Enrichment

CVSS: 1.8 LOW
EPSS: 0.14%
EPSS Percentile: 2.79%
CISA KEV: Not listed

Description

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash. This issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: cvd@cert.pl
Published: 06-Oct-2026 18:17
Last Modified: 06-Oct-2026 22:03
EPSS Date: 2026-10-13
CWE: CWE-122

CVSS Vector


            CVSS:4.0                            AV:L /
                            AC:H /
                            AT:N /
                            PR:N /
                            UI:A /
                            VC:N /
                            VI:N /
                            VA:L /
                            SC:L /
                            SI:L /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 14-Oct-2026 21:15
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-75818 Microsoft October 2026 Updates Fix 1,411 Flaws, Including Three Zero-Days

CVE (1235)

People (2)

MITRE ATT&CK (1)

Vendors (14)

Products (87)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.