CVE-2026-88050— Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values
Quick assessment
Affected
tesseract-ocr tesseract
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
tesseract-ocr Tesseract是tesseract-ocr组织的一款可将图像文字转换为可编辑文本的光学字符识别组件。 tesseract-ocr Tesseract 5.5.3及之前版本存在缓冲区错误漏洞，该漏洞源于RecodedCharID::DeSerialize验证length_时接受来自特制.traineddata recoder组件的负code_值，导致UnicharCompress::ComputeCodeRange产生为零的code_range_，进而SetupDecoder
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| tesseract-ocr | tesseract | <= 5.5.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88050
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values
Source: CVE Program / CVE List V5
Vulnerability Description
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector. The resulting out-of-bounds bit write uses a large wrapped index and reliably causes a wild-address crash or allocation failure on the default LSTM engine. No fixed release is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Vulnerability Title
tesseract-ocr Tesseract 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
tesseract-ocr Tesseract是tesseract-ocr组织的一款可将图像文字转换为可编辑文本的光学字符识别组件。 tesseract-ocr Tesseract 5.5.3及之前版本存在缓冲区错误漏洞，该漏洞源于RecodedCharID::DeSerialize验证length_时接受来自特制.traineddata recoder组件的负code_值，导致UnicharCompress::ComputeCodeRange产生为零的code_range_，进而SetupDecoder
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tesseract-ocr | tesseract | <= 5.5.3 | - |
|
II. Public POCs for CVE-2026-88050
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88050
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-88050 (1)
Vendor Advisories for CVE-2026-88050 (1)
Same Patch Batch · tesseract-ocr · 2026-09-10 · 8 CVEs total
| CVE-2026-88049 | 8.6 HIGH | Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatc |
| CVE-2026-88048 | 8.6 HIGH | Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matri |
| CVE-2026-88047 | 8.6 HIGH | Tesseract: ReadNormProtos stack buffer overflow |
| CVE-2026-88051 | 8.6 HIGH | Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/ |
| CVE-2026-88053 | 8.6 HIGH | Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts i |
| CVE-2026-88052 | 7.8 HIGH | Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynch |
| CVE-2026-88054 | 6.9 MEDIUM | Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load |
IV. Related Vulnerabilities
Same product: tesseract
-
CVE-2026-119341
Tesseract: File-controlled pointers still reach `delete` in -
CVE-2026-119340
Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer c -
CVE-2026-119339
Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) tri -
CVE-2026-119338
Tesseract: Double free and use after free in the PAGE XML re -
CVE-2026-88054
Tesseract: Denial of service via empty-stack dereference in
Same vendor: tesseract-ocr
-
CVE-2026-119341
Tesseract: File-controlled pointers still reach `delete` in -
CVE-2026-119340
Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer c -
CVE-2026-119339
Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) tri -
CVE-2026-119338
Tesseract: Double free and use after free in the PAGE XML re -
CVE-2026-88054
Tesseract: Denial of service via empty-stack dereference in
Same weakness: CWE-787
-
CVE-2026-119777
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: st -
CVE-2026-104067
Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Imp -
CVE-2026-104066
Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pix -
CVE-2026-104065
Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx -
CVE-2026-104062
Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Lo