CVE-2026-88052
Received Received - Intake

Heap Corruption in Tesseract OCR Engine

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backwards_compatible can leave the vector unchanged for an empty, duplicate, or already-encodable representation, causing id to become larger than unichars.size(). Subsequent set_* calls and the write to unichars[id].properties.enabled then write UNICHAR_PROPERTIES beyond the vector during initialization in both the default LSTM and legacy engines, causing heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88052
EUVD
EUVD-2026-75629

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tesseract_ocr tesseract to 5.5.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88052 is a heap out-of-bounds write vulnerability in Tesseract OCR engine versions 5.5.3 and earlier. It occurs in the UNICHARSET::load_via_fgets function where a trusted unichar count is used as a loop bound but the unichars vector is not pre-sized. When duplicate or empty character representations are encountered, the vector size desynchronizes from the loop index id, causing out-of-bounds writes when setting properties for subsequent entries. This leads to heap corruption, crashes, or potential controlled corruption during initialization.

Detection Guidance

Detecting this vulnerability requires checking the Tesseract OCR version and inspecting unicharset files for malformed content. Use 'tesseract --version' to verify if your version is 5.5.3 or earlier. Examine unicharset files in TESSDATA for duplicate entries or non-positive counts using text editors or 'grep' commands like 'grep -n "^COUNT" unicharset' to check header values.

Impact Analysis

This vulnerability can cause heap corruption, application crashes, or potentially allow an attacker to execute arbitrary code on your system. Since it is triggered by processing malformed unicharset files, an attacker could craft a file that exploits this issue when Tesseract processes it. The impact includes loss of confidentiality, integrity, and availability of the affected system as the CVSS score indicates high impact in all three areas.

Mitigation Strategies

Immediately stop using Tesseract versions 5.5.3 or earlier. Replace them with versions from trusted sources that include the fix. Avoid using untrusted traineddata files and only use those obtained from official Tesseract repositories or verified providers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart