Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
Published: 2026-09-10
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Out-of-bounds write causing crashes and potential denial of service
Action: Monitor
AI Analysis

Impact

Tesseract’s unvalidated negative recoder code values trigger an out-of-bounds bit write, producing a wild-address crash or allocation failure in the default LSTM engine. This memory corruption is classified as a type‑of‑memory‑corruption vulnerability (CWE‑787) and is rated a moderate severity CVSS score of 6.9.

Affected Systems

The vulnerability afflicts the Tesseract OCR engine, specifically versions 5.5.3 and earlier. The affected product is identified as tesseract‑ocr:tesseract by the CNA.

Risk and Exploitability

The exploit requires a crafted .traineddata recoder component with negative code values. Since the flaw is triggered when loading these files, the attack vector is likely local, though any environment that processes untrusted OCR data could be impacted. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating a moderate but not immediately threatening risk. Without an official patch, the best precaution is to monitor updates and constrain the input of .traineddata files to trusted sources.

Generated by OpenCVE AI on September 10, 2026 at 19:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Stay updated on the latest Tesseract releases and apply fixes as soon as they are available
  • Restrict Tesseract from loading untrusted .traineddata files by validating or filtering recoder components before processing
  • If possible, disable or bypass the default LSTM engine when processing sensitive data, or use a wrapper that prevents the out-of-bounds write by ensuring a valid code range

Generated by OpenCVE AI on September 10, 2026 at 19:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
Title Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values
Weaknesses CWE-787
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T17:30:29.252Z

Reserved: 2026-09-09T21:22:45.433Z

Link: CVE-2026-88050

cve-icon Vulnrichment

Updated: 2026-09-10T17:28:26.035Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-10T17:17:09.223

Modified: 2026-09-10T19:54:25.810

Link: CVE-2026-88050

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T19:30:06Z

Weaknesses