Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
Published: 2026-09-10
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-Bounds Heap Write
Action: Mitigate
AI Analysis

Impact

The vulnerability involves an out‑of‑bounds heap write in the GenericVector::read function of the Tesseract OCR engine. It occurs when the function reads two independent integer fields, reserved and size_used_, from a .traineddata file without validating that the allocated buffer is large enough for size_used a backing array based on the reserved value but proceeds to write size_used_ FontInfo structures, overrunning the buffer and corrupting adjacent heap objects. This can cause a crash or, if exploited, controlled memory corruption and is a classic heap buffer overflow (CWE‑787).

Affected Systems

The affected product is the Tesseract OCR engine, version 5.5.3 and all earlier releases. No newer releases have a fix at the time of this review.

Risk and Exploitability

The CVSS base score of 8.6 indicates high severity. The vulnerability requires a crafted .traineddata file with a version_id of 4 or later. Attackers are most likely to supply a malicious model to an OCR service that loads user files, such as a web‑based OCR API or and the vulnerability is not listed in CISA KEV, but the lack of a patch and the potential for heap corruption make the risk significant.

Generated by OpenCVE AI on September 10, 2026 at 23:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch from commit 56e09ca12e751623fe796ce1554ce704bffd2ef0 once a new release is available.
  • Add validation logic that ensures the reserved value is not smaller than size_used_ before allocating or writing, and reject .traineddata files that violate this invariant.
  • Execute Tesseract OCR inside a sandbox or low‑privilege container, restricting file permissions so that any heap corruption cannot affect the broader system.

Generated by OpenCVE AI on September 10, 2026 at 23:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 10 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.
Title Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields
Weaknesses CWE-787
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T17:37:01.063Z

Reserved: 2026-09-09T21:22:45.433Z

Link: CVE-2026-88051

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-10T18:18:14.177

Modified: 2026-09-10T19:54:25.810

Link: CVE-2026-88051

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-10T17:37:01Z

Links: CVE-2026-88051 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T00:00:07Z

Weaknesses