Out-of-Bounds Write Vulnerability in Tesseract OCR Engine
CVE-2026-88050

6.9MEDIUM

Key Information:

Vendor

Tesseract-ocr

Status
Tesseract
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88050?

The Tesseract OCR Engine versions 5.5.3 and earlier contain a vulnerability that occurs due to improper validation in the RecodedCharID::DeSerialize function of the unicharcompress.h file. This flaw allows negative code values to be processed from a specially crafted .traineddata recoder component. This, in turn, can lead to an out-of-bounds write when the code_range_ is computed to be zero, particularly when the SetupDecoder tries to access is_valid_start_ with this negative index. The impact is critical as it leads to a wild-address crash or allocation failure specifically on the default LSTM engine. Currently, no patched version is available.

Affected Version(s)

tesseract <= 5.5.3

References

https://github.com/tesseract-ocr/tesseract/security/advis...
x_refsource_CONFIRM
https://github.com/tesseract-ocr/tesseract/commit/c94a553...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.