Executive brief
Tesseract is an open-source optical character recognition (OCR) engine used to extract text from images and documents. A vulnerability in how it reads trained model files (.traineddata) allows a malicious model to trigger a heap memory corruption that can crash the application or potentially enable arbitrary code execution. Organizations relying on Tesseract to process untrusted or user-supplied training data face service disruption and data security risks.
Technical details
The vulnerability is a heap out-of-bounds write in the callback form of GenericVector::read (src/ccutil/genericvector.h). The function reads two independent int32 fields from the model file—reserved (used to allocate memory via reserve()) and size_used_ (used to control the write loop count)—with no validation or invariant check. An attacker can craft a malicious .traineddata file (specifically a TESSDATA_INTTEMP component with version_id ≥ 4) that sets reserved to a small value (e.g., 4) and size_used_ to a large value (e.g., 65536). When fontinfo_table_.read() is called during model initialization in intproto.cpp:850, the code allocates a small buffer via reserve() but writes a much larger number of FontInfo structures past the allocated memory, corrupting the heap. This is a real buffer overflow (not neutralized by NULL-buffer defenses) and can lead to crash or potentially controlled memory corruption. The fix is to cap size_used_ and enforce the invariant size_used_ ≤ reserved before the write loop, as already done in the DeSerialize overloads.
Affected products
- Tesseract OCR Tesseract 5.5.3 and earlier
Timeline
- 2026-08-25: disclosed: GitHub security advisory GHSA-88qp-4g94-3rf3 published
- 2026-09-10: advisory: CVE-2026-88051 published on NVD
- 2026: patched: Patch commit 56e09ca released in version 5.5.4