Summary
[5.3.4-11]
- Fix incomplete CVE-2026-88051: reset 'size_used_' on validation failure
in 'GenericVector::read()'; check 'fontinfo_table_' and 'fontset_table_'
read return values in 'ReadIntTemplates'
[5.3.4-10]
- Replace ASSERT_HOST around LSTM model Load with graceful error
handling; fixes denial-of-service crash (exit 134) when CVE
validation correctly rejects a malformed LSTM traineddata file
[5.3.4-9]
- CVE-2026-88053: add void-to-bool failure propagation for
'InitAdaptiveClassifier', 'program_editup', and
'init_tesseract_internal'; without this, validation fires but the
process SIGSEGV (exit 139) because the failure never reaches Init
[5.3.4-8]
- Backport fixes for CVE-2026-88047, CVE-2026-88048, CVE-2026-88049,
CVE-2026-88051, CVE-2026-88052, CVE-2026-88053
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | tesseract | 0:5.3.4-11.el10_2 |
| Oracle Linux · 10 | tesseract-devel | 0:5.3.4-11.el10_2 |
Vulnerabilities 6
-
High 8.6
Tesseract: ReadNormProtos stack buffer overflow
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token…
-
High 8.6
Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward,…
-
High 8.6
Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::Ad…
-
High 8.6
Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant che…
-
High 8.6
Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those…
-
High 7.8
Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backward…