CVE-2026-88051
Received Received - Intake

Heap Out-of-Bounds Write in Tesseract OCR Engine

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88051
EUVD
EUVD-2026-75627

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tesseract_ocr tesseract to 5.5.4 (exc)
tesseract_ocr tesseract From 5.5.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88051 is a heap out-of-bounds write vulnerability in Tesseract OCR versions 5.5.3 and earlier. It occurs in the GenericVector::read function where two fields, reserved and size_used_, are read from a model file without validation. A crafted .traineddata file can set reserved to a small value and size_used_ to a large value, causing the function to allocate a small buffer but write beyond its bounds. This leads to heap corruption, crashes, or potential controlled memory corruption.

Detection Guidance

Detecting this vulnerability requires checking the Tesseract OCR version and inspecting .traineddata files for malformed fontinfo tables. Use 'tesseract --version' to check the installed version. If version 5.5.3 or earlier is detected, the system is vulnerable. Additionally, examine .traineddata files for version 4 or later inttemp components with suspicious reserved and size_used_ values.

Impact Analysis

This vulnerability can allow an attacker to corrupt memory during file parsing, leading to crashes or arbitrary code execution. Since the attack requires no privileges or user interaction, it is highly exploitable. Users processing untrusted .traineddata files are at risk of heap corruption, which could compromise system integrity and availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution or memory corruption through crafted .traineddata files. Exploitation may lead to unauthorized data access, modification, or disclosure, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update Tesseract OCR to version 5.5.4 or later if available. If updating is not possible, avoid using untrusted .traineddata files, especially those with version 4 or later inttemp components. Restrict file parsing to trusted sources to prevent crafted files from being processed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart