Skip to content
OpenAdvisories
High ALSA-2026:95086 6 CVEs

Important: tesseract security update

Published Nov 4, 2026 · Updated Nov 5, 2026

Ecosystem: AlmaLinux

Summary

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.

Security Fix(es):

* tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data (CVE-2026-88048)
* tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file (CVE-2026-88047)
* tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service (CVE-2026-88049)
* tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model (CVE-2026-88051)
* tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file (CVE-2026-88053)
* tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution (CVE-2026-88052)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 tesseract-devel 4.1.1-11.el9_8

Vulnerabilities 6

  • High 8.6
    CVE-2026-88047

    Tesseract: ReadNormProtos stack buffer overflow

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88048

    Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward,…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88049

    Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::Ad…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88051

    Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant che…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88053

    Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 7.8
    CVE-2026-88052

    Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backward…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-88047
  • report
    https://access.redhat.com/security/cve/CVE-2026-88048
  • report
    https://access.redhat.com/security/cve/CVE-2026-88049
  • report
    https://access.redhat.com/security/cve/CVE-2026-88051
  • report
    https://access.redhat.com/security/cve/CVE-2026-88052
  • report
    https://access.redhat.com/security/cve/CVE-2026-88053
  • report
    https://bugzilla.redhat.com/2531546
  • report
    https://bugzilla.redhat.com/2531550
  • report
    https://bugzilla.redhat.com/2531554
  • report
    https://bugzilla.redhat.com/2531566
  • report
    https://bugzilla.redhat.com/2531573
  • report
    https://bugzilla.redhat.com/2531579
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-95086.html