CVE-2026-88054 is an out-of-bounds read vulnerability in the tesseract-ocr engine versions 5.5.3 and earlier. It occurs when a crafted .traineddata model with a zero-length stack for certain network layers is processed, leading to a dereference of an invalid pointer and a deterministic crash causing denial of service. No patch or fixed release is currently available.
CVE-2026-88052 is a high-severity vulnerability in the open source OCR engine tesseract, affecting version 5.5.3 and earlier. The flaw arises from improper validation of an array index in the UNICHARSET::load_via_fgets function, where an unchecked index can lead to out-of-bounds writes during initialization. This can cause heap corruption, crashes, or potentially controlled memory corruption. No official fix or patched release is available as of the latest review.
CVE-2026-88051 is a high severity heap out-of-bounds write vulnerability in tesseract-ocr versions 5.5.3 and earlier. It arises from improper handling of the GenericVector::read callback in the OCR engine's .traineddata model parsing, allowing a crafted input to cause heap corruption or crashes. No official fix is available as of the latest review.
CVE-2026-88053 is a high-severity heap out-of-bounds write vulnerability in the open source OCR engine Tesseract, affecting version 5.5.3 and earlier. The flaw occurs in the Classify::ReadIntTemplates function when processing crafted .traineddata files, where certain counts are used as loop bounds without proper validation. This can lead to heap corruption, crashes, or potentially controlled memory corruption during legacy-classifier initialization before OCR processing starts. No official fix or patch is available as of the latest review.
CVE-2026-88048 is a high-severity vulnerability in the open source OCR engine Tesseract, affecting version 5.5.3 and earlier. The flaw arises from improper validation of deserialized layer scalars in the FullyConnected::DeSerialize function, leading to inconsistent dimensions used during matrix operations. This can cause heap out-of-bounds reads and writes, resulting in heap corruption, crashes, information disclosure, or potentially controlled memory corruption. No official fix or patch is available as of the latest review.
CVE-2026-88050 is an out-of-bounds write vulnerability in the tesseract-ocr engine versions 5.5.3 and earlier. It arises from improper handling of negative code values in the RecodedCharID::DeSerialize function, leading to an invalid index used in a size-zero vector. This causes a wild-address memory write that can crash the application or cause allocation failures. No official fix or patch is available as of the latest review.
CVE-2026-88049 is a high-severity heap out-of-bounds write vulnerability in the open source OCR engine tesseract, affecting version 5.5.3 and earlier. The flaw arises from insufficient bounds checking in certain functions handling LSTM network data, allowing a crafted NT_LSTM layer to cause heap corruption during recognition. This can lead to crashes or potentially controlled memory corruption. No official fix or patch is available as of the latest review.
Multiple stack and heap buffer overflow vulnerabilities exist in tesseract-ocr version 5.5.3 and earlier. These include a stack-based buffer overflow in Classify::ReadNormProtos, heap out-of-bounds read/write in FullyConnected::DeSerialize, unchecked heap writes in LSTM layers, and other memory corruption issues during parsing of crafted .traineddata files. These flaws can lead to denial of service, crashes, heap corruption, information disclosure, or potentially control-flow hijacking. No fixed releases are available as of the latest review.
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.