Heap Corruption Vulnerability in Tesseract OCR Engine

CVE-2026-88052

What is CVE-2026-88052?

The Tesseract OCR engine, in versions 5.5.3 and earlier, contains a vulnerability within the UNICHARSET::load_via_fgets function. This issue arises because it improperly trusts the declared unichar count as a bound for loop iterations, leading to unchecked indices into the unichars vector. Specifically, the unichar_insert_backwards_compatible function can leave the vector in an unchanged state for certain representations, which may result in the index exceeding the size of the vector. This flaw can provoke heap corruption, crashes, or controlled corruption when subsequent function calls attempt to write beyond the allocated memory during initialization. As of now, no fix has been released to address this vulnerability.

References