Heap Corruption Vulnerability in Tesseract OCR Engine Affects Tesseract Software

CVE-2026-88051

What is CVE-2026-88051?

Tesseract OCR Engine, an open-source optical character recognition tool, contains a vulnerability in versions 5.5.3 and earlier. The issue lies in the callback form of GenericVector::read, which improperly accesses the reserved and size_used_ fields from a .traineddata model without necessary checks. This flaw enables attackers to manipulate the TESSDATA_INTTEMP component to allocate insufficient space while simultaneously assigning a significantly larger size_used_ value. As a result, the callback could lead to heap out-of-bounds write operations affecting FontInfo structures, causing both heap corruption and system instability. Currently, no fixed release is available.

References