ANT-2026-BDHSQ5GE · hunspell

stack-buffer-overflow high

Severity Claude critical · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-BDHSQ5GE: Stack-buffer-overflow in hunspell

libFuzzer ran the affdicfuzzer target (likely a Hunspell .aff/.dic dictionary parser) against a single PoC input and terminated with EXIT_CODE:1. No AddressSanitizer/UBSan tag, READ/WRITE access shape, or stack frames were produced, so the crash type, faulting function, and source location cannot be determined from this output. The trigger is whatever bytes are in /tmp/poc, presumably a malformed affix/dictionary blob.

Target

Project: hunspell

Technical Details

The affdicfuzzer harness exited with code 1 on the supplied PoC; no sanitizer report or stack trace was emitted.

Crash trace:

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3267561284
INFO: Loaded 1 modules   (18708 inline 8-bit counters): 18708 [0x64a4c64bebe0, 0x64a4c64c34f4), 
INFO: Loaded 1 PC tables (18708 PCs): 18708 [0x64a4c64c34f8,0x64a4c650c638), 
/out/affdicfuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-BDHSQ5GE.

Reference: ANT-2026-BDHSQ5GE
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict
true positive
Severity
high
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-24 Reported to tracker
  2. 2026-04-24 Sent to maintainer
  3. 2026-04-27 Maintainer acknowledged
  4. 2026-05-05 Patch released
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

6b37beac928674a1992b507037020db1c3552d4f92e3832335653f53436fce42a179e116939dc87b348264691a215ce974eb1db7793f2dd79e09b437aad94ce7

Committed 2026-05-07 03:18 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-BDHSQ5GE",
  "bug_class": "Stack-buffer-overflow",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-24T18:26:39+00:00",
  "description": "libFuzzer ran the affdicfuzzer target (likely a Hunspell .aff/.dic dictionary parser) against a single PoC input and terminated with EXIT_CODE:1. No AddressSanitizer/UBSan tag, READ/WRITE access shape, or stack frames were produced, so the crash type, faulting function, and source location cannot be determined from this output. The trigger is whatever bytes are in /tmp/poc, presumably a malformed affix/dictionary blob.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "hunspell",
  "reproduction": null,
  "technical_details": null,
  "title": "Stack-buffer-overflow in hunspell",
  "vendor_severity": "high"
}