CVE-2026-88050

Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values

Published Sep 10, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.

Analysis

Technical impact

T versions 5.5.3 and earlier allows negative code values to bypass length validation. This defect leads to an out‑of‑bounds bit write during decoding, causing wild‑address crashes or allocation failures in the default LSTM engine. The vulnerability is a classic buffer overflow (CWE‑787) and is rated as moderate severity with a CVSS score of 6.9.

Affected Systems

The flaw affects the Tesseract OCR engine, identified by the CNA as tesseract‑ocr:tesseract. All releases up to and including 5.5.3 are susceptible; no fixed release has been released at the time of review.

Risk and Exploitability

An attacker must supply a crafted .traineddata file containing a recoder with negative code values to trigger the defect. The attack vector is local or remote via untrusted OCR data. Because the flaw manifests during data loading, any system that processes external OCR input could be impacted. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate risk that is not currently widely exploited.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

tesseract-ocr

tesseract

affected

Version	Status	Constraints
`<= 5.5.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:tesseract-ocr:tesseract_ocr:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Tesseract Project

Tesseract

Version	Status	Scheme	Platform
`[0,5.5.3]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply an official Tesseract upgrade when a patch version becomes available
Validate or filter recoder components in .traineddata files before loading them, ensuring that code values are non‑negative and within bounds
Run OCR processing in a sandboxed or isolated environment to contain any memory‑corruption crash from affecting the broader system

Generated by OpenCVE AI on September 11, 2026 at 00:14 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8882-1	Tesseract vulnerabilities

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.150% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7v9h-3q3m-w68g
https://nvd.nist.gov/vuln/detail/CVE-2026-88050
https://www.cve.org/CVERecord?id=CVE-2026-88050

History

Sep 14, 2026 9:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Tesseract-ocr Tesseract-ocr tesseract Ocr
CPEs		cpe:2.3:a:tesseract-ocr:tesseract_ocr::::::::
Vendors & Products		Tesseract-ocr Tesseract-ocr tesseract Ocr
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Sep 13, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Tesseract Project Tesseract Project tesseract
Vendors & Products		Tesseract Project Tesseract Project tesseract

Sep 11, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-88050 https://www.cve.org/CVERecord?id=CVE-2026-88050
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 10, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
Title		Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values
Weaknesses		CWE-787
References		https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7v9h-3q3m-w68g
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`