Executive brief
Tesseract is an open-source OCR engine used to extract text from images and documents. A flaw in how it loads trained neural network models allows an attacker to craft a malicious model file that triggers memory corruption when processing any image, potentially crashing the application or leaking sensitive data from system memory.
Technical details
The vulnerability is a heap buffer overflow (CWE-787) and out-of-bounds read (CWE-125) in the FullyConnected::DeSerialize function in src/lstm/fullyconnected.cpp. The deserialization code fails to validate that the weight-matrix dimensions (dim1, dim2) match the declared layer scalars (ni_, no_). During FullyConnected::Forward, MatrixDotVector writes w.dim1() results into temp_line (sized from no_) and reads w.dim2()-1 inputs from curr_input (sized from ni_). By crafting a .traineddata file with mismatched dimensions—e.g., declaring no_=1, ni_=1 but providing a weight matrix with dim1=60000, dim2=2—an attacker triggers memory writes far beyond the allocated buffer. This fires on the first recognition step, affecting all LSTM models. A patch was committed on 2026-08-25 that validates dimension consistency at load time; no released version contains the fix yet.
Affected products
- Tesseract Tesseract OCR 5.5.3 and earlier
Timeline
- 2026-09-10: disclosed: CVE-2026-88048 and GHSA-q44c-23p6-5mw6 published
- 2026-08-25: patched: Fix committed (validation added to FullyConnected::DeSerialize); no released version yet