CVE-2026-88050
Received Received - Intake

Tesseract OCR Engine Code Execution via Negative Code Value

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88050
EUVD
EUVD-2026-75593

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google tesseract to 5.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88050 is an out-of-bounds write vulnerability in Tesseract OCR versions 5.5.3 and earlier. It occurs during deserialization of recoder code values in the UnicharCompress component. The vulnerability allows a crafted .traineddata file to trigger an out-of-bounds write by providing negative code values, which bypass existing length checks. This leads to a crash due to wild-address access when indexing a size-zero vector.

Detection Guidance

To detect this vulnerability, inspect Tesseract OCR versions for 5.5.3 or earlier. Check for crashes when loading .traineddata files, particularly those from untrusted sources. Monitor system logs for wild-address crashes or allocation failures during OCR operations.

Impact Analysis

The primary impact is a denial of service through application crashes. An attacker could exploit this by providing a maliciously crafted .traineddata file, causing Tesseract to crash when processing OCR tasks. The vulnerability does not allow arbitrary code execution and requires no privileges or user interaction to trigger.

Mitigation Strategies

Immediately stop using .traineddata files from untrusted sources. Validate all recoder components before loading. Monitor for crashes and update to a patched version once available. Implement strict input validation for OCR inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88050. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart