Skip to content
OpenAdvisories
High USN-8882-1 10 CVEs

tesseract vulnerabilities

Published Oct 6, 2026 · Updated Oct 6, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Tesseract incorrectly handled crafted .traineddata
models. An attacker could possibly use this issue to cause Tesseract to
crash, resulting in a denial of service. (CVE-2026-73067)

It was discovered that Tesseract did not properly validate dimensions in
crafted .traineddata models. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-73066)

It was discovered that Tesseract did not properly limit token lengths in
crafted .traineddata models. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-88047)

It was discovered that Tesseract did not properly validate layer dimensions
in crafted .traineddata models. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-88048)

It was discovered that Tesseract did not properly validate layer sizes in
crafted .traineddata models. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-88049)

It was discovered that Tesseract incorrectly handled negative character
codes in crafted .traineddata models. An attacker could possibly use this
issue to cause Tesseract to crash, resulting in a denial of service.
(CVE-2026-88050)

It was discovered that Tesseract did not properly validate vector sizes in
crafted .traineddata models. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-88051)

It was discovered that Tesseract did not properly validate character IDs in
crafted .traineddata models. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-88052)

It was discovered that Tesseract did not properly validate classifier
counts in crafted .traineddata models. An attacker could possibly use this
issue to execute arbitrary code. (CVE-2026-88053)

It was discovered that Tesseract incorrectly handled empty network layers
in crafted .traineddata models. An attacker could possibly use this issue to
cause Tesseract to crash, resulting in a denial of service.
(CVE-2026-88054)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS tesseract 3.03.02-3ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS tesseract 3.04.01-4ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS tesseract 4.00~git2288-10f4998a-2ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS tesseract 4.1.1-2ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS tesseract 4.1.1-2.1ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS tesseract 5.3.4-1ubuntu0.1~esm1
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS tesseract 5.5.0-1ubuntu0.1~esm1

Vulnerabilities 10

  • High 8.6
    CVE-2026-88047

    Tesseract: ReadNormProtos stack buffer overflow

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of a .traineddata file and uses std::istream::operator>>(char*) to extract a whitespace-delimited token…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88048

    Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward,…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88049

    Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::Ad…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88051

    Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant che…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 8.6
    CVE-2026-88053

    Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • High 7.8
    CVE-2026-88052

    Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. unichar_insert_backward…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • Medium 6.9
    CVE-2026-88050

    Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRan…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • Medium 6.9
    CVE-2026-88054

    Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layers in a crafted .train…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • Medium 6.8
    CVE-2026-73066

    Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

    Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the conv…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu
  • Medium 6.7
    CVE-2026-73067

    Tesseract: Heap OOB read in the DAWG loader

    Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load ca…

    tesseract-ocr tesseract tesseract tesseract Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-73066
  • report
    https://ubuntu.com/security/CVE-2026-73067
  • report
    https://ubuntu.com/security/CVE-2026-88047
  • report
    https://ubuntu.com/security/CVE-2026-88048
  • report
    https://ubuntu.com/security/CVE-2026-88049
  • report
    https://ubuntu.com/security/CVE-2026-88050
  • report
    https://ubuntu.com/security/CVE-2026-88051
  • report
    https://ubuntu.com/security/CVE-2026-88052
  • report
    https://ubuntu.com/security/CVE-2026-88053
  • report
    https://ubuntu.com/security/CVE-2026-88054