CVE-2019-20433

CVE-2019-20433 describes a critical buffer over-read vulnerability in GNU Aspell versions prior to 0.60.8, specifically within the libaspell.a library. This flaw allows an attacker to read beyond the intended buffer when processing strings ending with a single null byte, particularly if the encoding is set to ucs-2 or ucs-4 via external configurations like the ASPELL_CONF environment variable. With a CVSS score of 9.1 (CRITICAL), this vulnerability presents a high risk due to its network-based attack vector, low attack complexity, and potential for high impact on confidentiality and availability, without requiring user interaction or privileges. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.