Medium severity · published Sep 10, 2026
CVE-2026-88050
Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
tesseract · tesseract-ocr
<= 5.5.3 · source: vendor
TO
Tesseract Ocr · Tesseract-ocr
through 5.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-88050
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-88050
Patch
https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f
Vendor Advisory
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7v9h-3q3m-w68g
More from tesseract
7.8
CVE-2026-88053
Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata
7.8
CVE-2026-88052
Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization
7.8
CVE-2026-88051
Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields
7.8
CVE-2026-88047
Tesseract: ReadNormProtos stack buffer overflow
7.1
CVE-2026-88048
Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch