Stack Buffer Overflow in Tesseract OCR Engine Affecting Multiple Versions

CVE-2026-88047

What is CVE-2026-88047?

Tesseract, an open-source optical character recognition (OCR) engine, contains a stack buffer overflow vulnerability due to improper parsing in its Classify::ReadNormProtos method. Specifically, versions up to 5.5.3 process the NORMPROTO component of a .traineddata file without adequate stream width management, allowing an attacker to exploit the fixed 61-byte stack buffer. This oversight can cause stack corruption and denial of service, potentially leading to control-flow hijacking in environments utilizing standard-library implementations. Notably, builds utilizing Apple's libc++ C++20 bounded array overload feature are safeguarded against this issue, while those based on the more common libstdc++ remain at risk. Currently, no fix has been released for this vulnerability.

References