CVE-2026-88052

Tesseract 5.5.3 and earlier contains a flaw in Plumbing::DeSerialize that accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layers in a crafted .traineddata model. During LSTMRecognizer initialization, CacheXScaleFactor dereferences stack_[0] on the empty vector and invokes a virtual method through an invalid Network pointer.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in Classify::ReadIntTemplates, which reads NumClassPruners, NumClasses, and NumProtoSets from a .traineddata file without validating them against MAX_* limits. Oversized values cause out-of-bounds pointer writes on the heap during classifier initialization.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in GenericVector::read, which reads reserved and size_used_ fields from a .traineddata file without caps. A crafted file can set reserved to a small value and size_used_ to a large value, causing out-of-bounds writes of FontInfo structures.

In Tesseract version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector, causing an out-of-bounds bit write and a crash or allocation failure. No fixed release is available.

Tesseract 5.5.3 and earlier fails to validate dimension consistency in NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart. A crafted .traineddata file with an NT_LSTM layer can cause a heap out-of-bounds write during the first recognition step on the default LSTM engine. No fixed release is available.

Tesseract 5.5.3 and earlier does not validate the deserialized scalars ni_ and no_ against weight-matrix dimensions in FullyConnected::DeSerialize. A crafted .traineddata file with an NT_SOFTMAX layer can cause a heap out-of-bounds write and read on the default LSTM engine. No fixed release is available.

Tesseract 5.5.3 and earlier, in Classify::ReadNormProtos, extracts a whitespace-delimited token from a .traineddata file into a fixed 61-byte stack buffer without setting stream width. A token longer than 60 characters writes up to 39 attacker-controlled bytes past the buffer during TessBaseAPI::Init of the legacy engine. No fixed release is available.

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.

In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. The vulnerability stems from insufficient protection of temporary file operations.