Executive brief
Tesseract is an open-source optical character recognition (OCR) engine used to extract text from images. A flaw in how it deserializes and validates LSTM neural network layer configurations allows a maliciously crafted trained model file to trigger a heap buffer overflow during text recognition, potentially leading to application crashes or data corruption. Attackers can exploit this by distributing a booby-trapped model file that crashes the OCR service or corrupts memory when processing any document.
Technical details
The vulnerability is a heap out-of-bounds write in LSTM::Forward caused by incomplete input validation in LSTM::DeSerialize (lstm.cpp). The root cause: the deserialized na_ field (buffer size) is never validated against ns_ (derived from the CI gate matrix dim1 value), allowing them to mismatch significantly. During the forward pass, WriteTimeStepPart in networkio.cpp writes ns_ floats into a source_ buffer sized for na_, bypassing bounds checks that were only partially added in a prior CVE-2026-73066 fix. Exploitation requires a crafted .traineddata file that can be deserialized without authentication; no network vector exists since the engine must load a local or attacker-controlled model file. The fix involves strict dimension validation at deserialization time and extending bounds assertions to the unguarded WriteTimeStepPart and AddTimeStepPart functions. A patched version was committed but no released version is available as of publication.
Affected products
- Tesseract Tesseract 5.5.3 and earlier
Timeline
- 2026-08-25: disclosed: Fix committed by Stefan Weil
- 2026-08-25: advisory: GitHub Security Advisory GHSA-jgq8-pprg-vc68 published
- 2026-09-10: other: CVE-2026-88049 published on NVD