Skip to content
OpenAdvisories
High · 8.6 CVE-2026-88048 EUVD-2026-75591

Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch

Published Sep 10, 2026 · Updated Sep 11, 2026 · Assigned by GitHub_M

Vendor: tesseract-ocr Product: tesseract Package: tesseract Package: tesseract Ecosystem: Debian Ecosystem: Ubuntu

Description

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni_ and no_ against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in src/lstm/weightmatrix.cpp writes w.dim1() results into temp_line, which is sized from no_, and reads w.dim2() minus one inputs from curr_input, which is sized from ni_. A crafted .traineddata NT_SOFTMAX layer can therefore use inconsistent dimensions to cause a heap out-of-bounds write and read on the default LSTM engine, resulting in heap corruption, a crash, information disclosure, or potentially controlled corruption. No fixed release is available as of this review.

Affected products

VendorProductAffectedFixed
tesseract-ocr tesseract <= 5.5.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tesseract No fix yet —
Debian 13 tesseract No fix yet —
Debian 12 tesseract No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tesseract No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS tesseract 5.5.0-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 24.04 LTS tesseract 5.3.4-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 22.04 LTS tesseract 4.1.1-2.1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 20.04 LTS tesseract 4.1.1-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 18.04 LTS tesseract 4.00~git2288-10f4998a-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 16.04 LTS tesseract 3.04.01-4ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 14.04 LTS tesseract 3.03.02-3ubuntu0.1~esm1 USN-8882-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tesseract +1 5.3.4-11.el10_2 RHSA-2026:98624, RHSA-2026:95085
RHEL 9 tesseract +1 4.1.1-11.el9_8 RHSA-2026:98514, RHSA-2026:95086
RHEL 8 tesseract +1 4.1.1-7.el8_10 RHSA-2026:95725
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 TUS tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.8 E4S tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.6 EUS Long Life tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239
RHEL 8.6 AUS tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tesseract +1 5.3.4-11.el10_2 ALSA-2026:95085
AlmaLinux 9 tesseract-devel 4.1.1-11.el9_8 ALSA-2026:95086
AlmaLinux 8 tesseract +1 4.1.1-7.el8_10 ALSA-2026:95725

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tesseract +1 5.3.4-11.el10_2 RLSA-2026:98624, RLSA-2026:95085
Rocky Linux 9 tesseract 4.1.1-11.el9_8 RLSA-2026:98514, RLSA-2026:95086
Rocky Linux 8 tesseract 4.1.1-7.el8_10 RLSA-2026:95725

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tesseract-ocr 5.5.3-2.1 openSUSE-SU-2026:11887-1
openSUSE Leap 16.0 tesseract-ocr 5.5.3-bp160.1.1 openSUSE-SU-2026:21957-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tesseract +1 5.3.4-11.el10_2 ELSA-2026-95085
Oracle Linux 9 tesseract +1 4.1.1-11.el9_8 ELSA-2026-95086
Oracle Linux 8 tesseract +1 4.1.1-7.el8_10 ELSA-2026-95725

Advisories 22

References