CVE-2026-88050
Published: September 10th, 2026
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
Unknown
CVSS v2:
CVSS v2:
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| daily | tesseract (3.02.02) | Needs Triage | ||
| 26.3 | tesseract (3.02.02) | Needs Triage | ||
| 26.2 | tesseract (3.02.02) | Needs Triage | ||
| 26.1 | tesseract (3.02.02) | Needs Triage | ||
| 25.4 | tesseract (3.02.02) | Needs Triage | ||
| 25.3 | tesseract (3.02.02) | Needs Triage | ||
| 25.2 | tesseract (3.02.02) | Needs Triage | ||
| 25.1 | tesseract (3.02.02) | Needs Triage | ||
| 24.4 | tesseract (3.02.02) | Needs Triage | ||
| 24.4.0 | tesseract (3.02.02) | Needs Triage | ||
| 24.3 | tesseract (3.02.02) | Needs Triage | ||
| 24.2 | tesseract (3.02.02) | Needs Triage | ||
| 24.1 | tesseract (3.02.02) | Needs Triage | ||
| 23.3 | tesseract (3.02.02) | Needs Triage | ||
| 23.2 | tesseract (3.02.02) | Needs Triage | ||
| 23.1 | tesseract (3.02.02) | Needs Triage | ||
| 22.4 | tesseract (3.02.02) | Needs Triage | ||
| 22.3 | tesseract (3.02.02) | Needs Triage | ||
| 22.2 | tesseract (3.02.02) | Needs Triage | ||
| 22.1 | tesseract (3.02.02) | Needs Triage | ||
| 21.11 | tesseract (3.02.02) | Needs Triage | ||
| 21.8 | tesseract (3.02.02) | Needs Triage | ||
| 21.5.0 | tesseract (3.02.02) | Needs Triage | ||
| 21.2.0 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.19.3667 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.18.3599 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.16.3445 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.15.3368 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.14.3263 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.13.3179 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.12.3054 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.11.3040 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.11.2990 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.10.2934 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.9.2878 | tesseract (3.02.02) | Needs Triage | ||
| 11.4.8.2822 | tesseract (3.02.02) | Needs Triage |