CVE-2026-88047
Received Received - Intake

Heap Buffer Overflow in Tesseract OCR Engine

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token into a fixed 61-byte stack buffer without setting a stream width. The 100-byte line buffer can carry a token of up to 99 characters, so a token longer than 60 characters writes up to 39 attacker-controlled bytes past the buffer during TessBaseAPI::Init of the legacy engine, causing stack corruption, denial of service, and potentially control-flow hijacking on affected standard-library implementations. Builds using Apple's libc++ C++20 bounded array overload are incidentally protected, while typical libstdc++ builds remain affected. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88047
EUVD
EUVD-2026-75590

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tesseract_ocr tesseract to 5.5.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88047 is a stack-based buffer overflow in the Tesseract OCR engine's ReadNormProtos function. It occurs when parsing a maliciously crafted .traineddata file's NORMPROTO component. The function extracts a token into a fixed 61-byte stack buffer without length limits, allowing up to 39 bytes of overflow when the token exceeds 60 characters. This can corrupt stack memory during legacy engine initialization, causing crashes or potential code execution.

Detection Guidance

To detect this vulnerability, inspect Tesseract OCR installations for versions prior to 5.5.4. Check for malformed .traineddata files with NORMPROTO components containing tokens longer than 60 characters. Use file integrity monitoring to detect unexpected changes in Tesseract binaries or configuration files.

Impact Analysis

This vulnerability can cause denial-of-service crashes by corrupting stack memory during Tesseract's initialization with malicious .traineddata files. On systems without stack canaries or with bypassed protections, it may allow control-flow hijacking for arbitrary code execution. The impact depends on the application's use of Tesseract and the standard library implementation (libstdc++ remains vulnerable while libc++ is protected).

Mitigation Strategies

Upgrade Tesseract to version 5.5.4 or later if available. If upgrading is not possible, restrict access to Tesseract processing functions and validate all .traineddata files for malicious NORMPROTO tokens. Monitor systems for crashes or unusual behavior during OCR operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart