Skip to content
OpenAdvisories
High · 8.6 CVE-2026-88049 EUVD-2026-75592

Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch

Published Sep 10, 2026 · Updated Sep 10, 2026 · Assigned by GitHub_M

Vendor: tesseract-ocr Product: tesseract Package: tesseract Package: tesseract Ecosystem: Debian Ecosystem: Ubuntu

Description

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In LSTM::Forward in src/lstm/lstm.cpp, source_ is sized from the independently deserialized na_ field while the WriteTimeStepPart count is ns_, which comes from the CI gate WeightMatrix dim1() value. A crafted NT_LSTM layer can make ns_ much larger than na_, causing a heap out-of-bounds write during the first recognition step on the default LSTM engine and resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

Affected products

VendorProductAffectedFixed
tesseract-ocr tesseract <= 5.5.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tesseract No fix yet —
Debian 13 tesseract No fix yet —
Debian 12 tesseract No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tesseract No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS tesseract 5.5.0-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 24.04 LTS tesseract 5.3.4-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 22.04 LTS tesseract 4.1.1-2.1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 20.04 LTS tesseract 4.1.1-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 18.04 LTS tesseract 4.00~git2288-10f4998a-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 16.04 LTS tesseract 3.04.01-4ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 14.04 LTS tesseract 3.03.02-3ubuntu0.1~esm1 USN-8882-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tesseract +1 5.3.4-11.el10_2 RHSA-2026:98624, RHSA-2026:95085
RHEL 9 tesseract +1 4.1.1-11.el9_8 RHSA-2026:98514, RHSA-2026:95086
RHEL 8 tesseract +1 4.1.1-7.el8_10 RHSA-2026:95725
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 TUS tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.8 E4S tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.6 EUS Long Life tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239
RHEL 8.6 AUS tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tesseract +1 5.3.4-11.el10_2 ALSA-2026:95085
AlmaLinux 9 tesseract-devel 4.1.1-11.el9_8 ALSA-2026:95086
AlmaLinux 8 tesseract +1 4.1.1-7.el8_10 ALSA-2026:95725

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tesseract +1 5.3.4-11.el10_2 RLSA-2026:98624, RLSA-2026:95085
Rocky Linux 9 tesseract 4.1.1-11.el9_8 RLSA-2026:98514, RLSA-2026:95086
Rocky Linux 8 tesseract 4.1.1-7.el8_10 RLSA-2026:95725

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tesseract-ocr 5.5.3-2.1 openSUSE-SU-2026:11887-1
openSUSE Leap 16.0 tesseract-ocr 5.5.3-bp160.1.1 openSUSE-SU-2026:21957-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tesseract +1 5.3.4-11.el10_2 ELSA-2026-95085
Oracle Linux 9 tesseract +1 4.1.1-11.el9_8 ELSA-2026-95086
Oracle Linux 8 tesseract +1 4.1.1-7.el8_10 ELSA-2026-95725

Advisories 22

References