← Vulnerability feed

Vulnerability record · CVE-2026-88047 · published 10 September 2026

CVE-2026-88047: Tesseract-ocr tesseract ocr stack-based buffer overflow vulnerability

Tesseract Ocr · Tesseract Ocr

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token into a fixed 61-byte stack buffer without setting a stream width. The 100-byte line buffer can carry a token of up to 99 characters, so a token longer than 60 characters writes up to 39 attacker-controlled bytes past the buffer during TessBaseAPI::Init of the legacy engine, causing stack corruption, denial of service, and potentially control-flow hijacking on affected standard-library implementations. Builds using Apple's libc++ C++20 bounded array overload are incidentally protected, while typical libstdc++ builds remain affected. No fixed release is available as of this review.

8.6 CVSS 4.0 High EPSS 0.11% · top 98.6% CWE-121 · Stack-based buffer overflow
8.6CVSS 4.0 base score
0.11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
14 Sep 2026Last modified by NVD

Description

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token into a fixed 61-byte stack buffer without setting a stream width. The 100-byte line buffer can carry a token of up to 99 characters, so a token longer than 60 characters writes up to 39 attacker-controlled bytes past the buffer during TessBaseAPI::Init of the legacy engine, causing stack corruption, denial of service, and potentially control-flow hijacking on affected standard-library implementations. Builds using Apple's libc++ C++20 bounded array overload are incidentally protected, while typical libstdc++ builds remain affected. No fixed release is available as of this review.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84 Patch
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3 Vendor Advisory

Track CVE-2026-88047 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-88051Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads th…EPSS 0.17%8.6CVE-2026-88053Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, …EPSS 0.18%8.6CVE-2026-88049Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGene…EPSS 0.15%8.6CVE-2026-88048Tesseract-ocr tesseract ocr out-of-bounds read vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate th…EPSS 0.17%7.8CVE-2026-88052Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared uni…EPSS 0.18%7.8CVE-2021-36081Tesseract-ocr tesseract ocr use after free vulnerabilityTesseract OCR 5.0.0-alpha-20201231 has a one_ell_conflict use-after-free during a strpbrk call.EPSS 0.89%6.9CVE-2026-88054Tesseract-ocr tesseract ocr out-of-bounds read vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large networ…EPSS 0.15%6.9CVE-2026-88050Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ bu…EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2026-88047), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.