# CVE-2026-88049: Tesseract LSTM heap out-of-bounds write via dimension mismatch

Source: https://junglewise.ai/threats/cve-2026-88049-tesseract-lstm-heap-out-of-bounds-write-via-dimension-mismatch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88049 · Severity: medium · CVSS 5.5 · Published 2026-09-10

Tesseract is an open-source optical character recognition (OCR) engine used to extract text from images. A flaw in how it deserializes and validates LSTM neural network layer configurations allows a maliciously crafted trained model file to trigger a heap buffer overflow during text recognition, potentially leading to application crashes or data corruption. Attackers can exploit this by distributing a booby-trapped model file that crashes the OCR service or corrupts memory when processing any document.

## Quick answers

**Is CVE-2026-88049 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88049 being exploited in the wild.

**How severe is CVE-2026-88049?** Medium severity, with a CVSS score of 5.5, published 10 September 2026.

**Which products and versions are affected?** Tesseract Tesseract 5.5.3 and earlier.

**Is there a fix for CVE-2026-88049?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88049 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-88049?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap out-of-bounds write in LSTM::Forward caused by incomplete input validation in LSTM::DeSerialize (lstm.cpp). The root cause: the deserialized na_ field (buffer size) is never validated against ns_ (derived from the CI gate matrix dim1 value), allowing them to mismatch significantly. During the forward pass, WriteTimeStepPart in networkio.cpp writes ns_ floats into a source_ buffer sized for na_, bypassing bounds checks that were only partially added in a prior CVE-2026-73066 fix. Exploitation requires a crafted .traineddata file that can be deserialized without authentication; no network vector exists since the engine must load a local or attacker-controlled model file. The fix involves strict dimension validation at deserialization time and extending bounds assertions to the unguarded WriteTimeStepPart and AddTimeStepPart functions. A patched version was committed but no released version is available as of publication.

## Affected products

- Tesseract Tesseract 5.5.3 and earlier

## Timeline

- 2026-08-25: disclosed: Fix committed by Stefan Weil
- 2026-08-25: advisory: GitHub Security Advisory GHSA-jgq8-pprg-vc68 published
- 2026-09-10: other: CVE-2026-88049 published on NVD

## References

- [https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf](https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf)
- [https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68](https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68)