CVE-2026-88050: CWE-787: Out-of-bounds Write in tesseract-ocr tesseract
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
AI Analysis
Technical Summary
In tesseract-ocr version 5.5.3 and earlier, the RecodedCharID::DeSerialize function in src/ccutil/unicharcompress.h validates the length_ parameter but improperly accepts negative code_ values from a crafted .traineddata recoder component. This leads UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp to produce a code_range_ value of zero. Subsequently, SetupDecoder indexes the is_valid_start_ vector with the negative code on a zero-sized vector, causing an out-of-bounds bit write. This results in a wild-address crash or allocation failure on the default LSTM engine. As of the latest review, no patch or fixed release is available for this vulnerability.
Potential Impact
The vulnerability can cause a wild-address crash or allocation failure in tesseract-ocr when processing specially crafted .traineddata files. This may lead to denial of service or application instability. There is no indication of code execution or data corruption beyond the out-of-bounds write described.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should avoid using untrusted or unverified .traineddata files to mitigate risk until a patch is released. Monitor vendor advisories for updates regarding remediation.
CVE-2026-88050: CWE-787: Out-of-bounds Write in tesseract-ocr tesseract
Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
CVSS v4.0
Score 6.9medium
Affected software
tesseract-ocr
tesseract
pkg:github/tesseract-ocr/tesseractRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In tesseract-ocr version 5.5.3 and earlier, the RecodedCharID::DeSerialize function in src/ccutil/unicharcompress.h validates the length_ parameter but improperly accepts negative code_ values from a crafted .traineddata recoder component. This leads UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp to produce a code_range_ value of zero. Subsequently, SetupDecoder indexes the is_valid_start_ vector with the negative code on a zero-sized vector, causing an out-of-bounds bit write. This results in a wild-address crash or allocation failure on the default LSTM engine. As of the latest review, no patch or fixed release is available for this vulnerability.
Potential Impact
The vulnerability can cause a wild-address crash or allocation failure in tesseract-ocr when processing specially crafted .traineddata files. This may lead to denial of service or application instability. There is no indication of code execution or data corruption beyond the out-of-bounds write described.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users should avoid using untrusted or unverified .traineddata files to mitigate risk until a patch is released. Monitor vendor advisories for updates regarding remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-09T21:22:45.433Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa2dccdf76d26f025573a88
Added to database: 09/10/2026, 16:37:33 UTC
Last enriched: 09/10/2026, 16:51:47 UTC
Last updated: 09/10/2026, 17:37:58 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.