Is CVE-2026-88053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88053 being exploited in the wild.

How severe is CVE-2026-88053?

High severity, with a CVSS score of 7.8, published 10 September 2026.

Which products and versions are affected?

Tesseract OCR Tesseract 5.5.3 and earlier.

Is there a fix for CVE-2026-88053?

A patch was published on 2026-08-25: Fix committed to repository (commit 8b05746) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88053 attacked?

It is attacked with local access.

Am I affected by CVE-2026-88053?

Check whether you run Tesseract OCR Tesseract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88053: Tesseract OCR heap out-of-bounds write in inttemp deserialization

CVE-2026-88053 · Severity: high · CVSS 7.8 · Published 2026-09-10

Tesseract is an open-source OCR (optical character recognition) engine used to extract text from images. When processing specially crafted training data files (.traineddata), the engine fails to validate array bounds, allowing attackers to write beyond allocated memory. This can crash the application or potentially corrupt heap memory, affecting the availability and integrity of any system processing untrusted OCR training data.

Technologies: Tesseract OCR Tesseract. Vendors: Tesseract OCR.

Quick answers

Is CVE-2026-88053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88053 being exploited in the wild.
How severe is CVE-2026-88053?: High severity, with a CVSS score of 7.8, published 10 September 2026.
Which products and versions are affected?: Tesseract OCR Tesseract 5.5.3 and earlier.
Is there a fix for CVE-2026-88053?: A patch was published on 2026-08-25: Fix committed to repository (commit 8b05746) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88053 attacked?: It is attacked with local access.
Am I affected by CVE-2026-88053?: Check whether you run Tesseract OCR Tesseract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap out-of-bounds write in the Classify::ReadIntTemplates function (src/classify/intproto.cpp). When reading deserialization data from a .traineddata file's TESSDATA_INTTEMP component, the code reads three counts (NumClassPruners, NumClasses, NumProtoSets) directly from the untrusted file and uses them as loop bounds without validation against compile-time array capacity constants (MAX_NUM_CLASS_PRUNERS=1024, MAX_NUM_CLASSES=32767, MAX_NUM_PROTO_SETS=8). An attacker-supplied count larger than the fixed-size array capacity triggers pointer writes past array bounds during legacy classifier initialization, before any OCR processing occurs. The attack requires providing a maliciously crafted .traineddata file; no user interaction or authentication is needed. A patch has been committed and fixes input validation, but no formal release had been issued as of the advisory date.

Affected products

Tesseract OCR Tesseract 5.5.3 and earlier

Timeline

2026-08-25: disclosed: Security advisory published
2026-08-25: patched: Fix committed to repository (commit 8b05746)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.