CVE-2026-88053
Received Received - Intake

Heap Out-of-Bounds Write in Tesseract OCR Engine

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88053
EUVD
EUVD-2026-75630

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tesseract_ocr tesseract to 5.5.4 (exc)
tesseract_ocr tesseract to 5.5.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds write issue in Tesseract OCR versions 5.5.3 and earlier. It occurs in the Classify::ReadIntTemplates function which reads untrusted values (NumClassPruners, NumClasses, NumProtoSets) from a crafted .traineddata file without validating them against fixed array capacities. This allows excessive counts to trigger heap corruption during legacy-classifier initialization before OCR begins.

Detection Guidance

This vulnerability is triggered by a crafted .traineddata file and cannot be detected via standard network or system commands. Monitor for crashes during Tesseract initialization or OCR processing, especially when loading custom traineddata files. Check logs for heap corruption errors or segmentation faults in Tesseract processes.

Impact Analysis

An attacker could exploit this by providing a specially crafted .traineddata file to cause heap corruption, crashes, or potentially controlled memory corruption during Tesseract's initialization. This could lead to denial of service, application instability, or unauthorized code execution depending on the system's memory state.

Mitigation Strategies

Immediately stop using any custom or untrusted .traineddata files. Update to the latest Tesseract version if a patch is released. If no patch exists, avoid processing untrusted files and restrict access to Tesseract to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88053. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart