← Vulnerability feed

Vulnerability record · CVE-2026-88053 · published 10 September 2026

CVE-2026-88053: Tesseract-ocr tesseract ocr out-of-bounds write vulnerability

Tesseract Ocr · Tesseract Ocr

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

8.6 CVSS 4.0 High EPSS 0.18% · top 93.7% CWE-787 · Out-of-bounds write
8.6CVSS 4.0 base score
0.18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
16 Sep 2026Last modified by NVD

Description

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/tesseract-ocr/tesseract/commit/8b0574680f3b22f246ade6a4c8e3029104255c63 Patch
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv ExploitMitigationVendor Advisory
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv ExploitMitigationVendor Advisory

Track CVE-2026-88053 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-88051Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads th…EPSS 0.18%8.6CVE-2026-88049Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGene…EPSS 0.14%8.6CVE-2026-88047Tesseract-ocr tesseract ocr stack-based buffer overflow vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO com…EPSS 0.17%8.6CVE-2026-88048Tesseract-ocr tesseract ocr out-of-bounds read vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate th…EPSS 0.16%7.8CVE-2026-88052Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared uni…EPSS 0.18%7.8CVE-2021-36081Tesseract-ocr tesseract ocr use after free vulnerabilityTesseract OCR 5.0.0-alpha-20201231 has a one_ell_conflict use-after-free during a strpbrk call.EPSS 0.89%6.9CVE-2026-88054Tesseract-ocr tesseract ocr out-of-bounds read vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large networ…EPSS 0.15%6.9CVE-2026-88050Tesseract-ocr tesseract ocr out-of-bounds write vulnerabilityTesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ bu…EPSS 0.14%

Source: NIST National Vulnerability Database (record CVE-2026-88053), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.