Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88050

Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88050

Published

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88050

Published

tesseract

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "tesseract-ocr",
                    "product": "tesseract",
                    "versions": [
                        {
                            "version": "<= 5.5.3",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON