Executive brief
Tesseract is an open-source optical character recognition (OCR) engine used to extract text from images and documents. A vulnerability in how it loads character set definitions allows an attacker to craft a malformed file that triggers memory corruption, potentially crashing the application or enabling further exploitation during document processing.
Technical details
The vulnerability is a heap out-of-bounds write (CWE-787, CWE-129) in UNICHARSET::load_via_fgets (src/ccutil/unicharset.cpp). The function trusts a declared unichar count from the file as a loop bound and uses the loop index as an unchecked array index into the unichars vector. Because unichar_insert is a no-op for duplicate, empty, or already-encodable character representations, the vector size desynchronizes from the loop counter; subsequent set_* calls and property assignments write past the vector's end. The vulnerability is reachable at engine initialization via both LSTM (TESSDATA_LSTM_UNICHARSET) and legacy engine paths, and can be triggered by crafting a unicharset file with a duplicate character entry. No patched release is available as of the advisory date.
Affected products
- tesseract-ocr Tesseract 5.5.3 and earlier
Timeline
- 2026-08-25: disclosed: GitHub Security Advisory GHSA-2hm8-q5c7-c373 published
- 2026-09-10: advisory: NVD entry published for CVE-2026-88052