Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

Tesseract OCR can crash or be corrupted by crafted data file

CVE-2026-88051 · published 1 month ago
Summary

Versions of Tesseract OCR up to 5.5.3 may write outside of memory when loading a specially crafted trained data file. This can cause the program to stop working or allow an attacker to tamper with memory. Update to a version that fixes the issue as soon as one is released, or avoid using untrusted trained data files.

What to do
  • Update canonical tesseract to version 3.03.02-3ubuntu0.1~esm1.
  • Update canonical tesseract to version 3.04.01-4ubuntu0.1~esm1.
  • Update canonical tesseract to version 4.00~git2288-10f4998a-2ubuntu0.1~esm1.
  • Update canonical tesseract to version 4.1.1-2ubuntu0.1~esm1.
  • Update canonical tesseract to version 4.1.1-2.1ubuntu0.1~esm1.
  • Update canonical tesseract to version 5.3.4-1ubuntu0.1~esm1.
  • Update canonical tesseract to version 5.5.0-1ubuntu0.1~esm1.
Affected software
Ecosystem VendorProductAffected versions
– tesseract-ocr tesseract <= 5.5.3
Debian:12 debian tesseract All versions
Ubuntu:14.04:LTS canonical tesseract All versions
– tesseract-ocr tesseract_ocr <= 5.5.3
cpe:2.3:a:tesseract-ocr:tesseract_ocr:*:*:*:*:*:*:*:*
Ubuntu:Pro:14.04:LTS canonical tesseract < 3.03.02-3ubuntu0.1~esm1
Fix: upgrade to 3.03.02-3ubuntu0.1~esm1
Ubuntu:Pro:16.04:LTS canonical tesseract < 3.04.01-4ubuntu0.1~esm1
Fix: upgrade to 3.04.01-4ubuntu0.1~esm1
Ubuntu:Pro:18.04:LTS canonical tesseract < 4.00~git2288-10f4998a-2ubuntu0.1~esm1
Fix: upgrade to 4.00~git2288-10f4998a-2ubuntu0.1~esm1
Ubuntu:Pro:20.04:LTS canonical tesseract < 4.1.1-2ubuntu0.1~esm1
Fix: upgrade to 4.1.1-2ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTS canonical tesseract < 4.1.1-2.1ubuntu0.1~esm1
Fix: upgrade to 4.1.1-2.1ubuntu0.1~esm1
Ubuntu:Pro:24.04:LTS canonical tesseract < 5.3.4-1ubuntu0.1~esm1
Fix: upgrade to 5.3.4-1ubuntu0.1~esm1
Ubuntu:Pro:26.04:LTS canonical tesseract < 5.5.0-1ubuntu0.1~esm1
Fix: upgrade to 5.5.0-1ubuntu0.1~esm1
Original advisory text
Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published10 Sep 2026
Updated4 Nov 2026
First seen10 Sep 2026
Sources
CVE-2026-88051 · NVD
CVE-2026-88051 · MITRE
CVE-2026-88051 · OSV
GHSA-88qp-4g94-3rf3 · GHSA
DEBIAN-CVE-2026-88051 · OSV
UBUNTU-CVE-2026-88051 · OSV
Track software like this
Free during beta