Skip to content
OpenAdvisories
High · 8.6 CVE-2026-88051 EUVD-2026-75627

Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields

Published Sep 10, 2026 · Updated Sep 15, 2026 · Assigned by GitHub_M

Vendor: tesseract-ocr Product: tesseract Package: tesseract Package: tesseract Ecosystem: Debian Ecosystem: Ubuntu

Description

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size_used_ from a .traineddata model without a cap or an invariant check. reserve(reserved) allocates the backing array, but the callback loop writes size_used_ elements. A crafted TESSDATA_INTTEMP component with version_id 4 or later can therefore set reserved to a small value and size_used_ to a large value when fontinfo_table_.read(fp, read_info) is called from src/classify/intproto.cpp, causing a heap out-of-bounds write of FontInfo structures, heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

Affected products

VendorProductAffectedFixed
tesseract-ocr tesseract <= 5.5.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tesseract 5.5.4-1 —
Debian 13 tesseract No fix yet —
Debian 12 tesseract No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tesseract No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS tesseract 5.5.0-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 24.04 LTS tesseract 5.3.4-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 22.04 LTS tesseract 4.1.1-2.1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 20.04 LTS tesseract 4.1.1-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 18.04 LTS tesseract 4.00~git2288-10f4998a-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 16.04 LTS tesseract 3.04.01-4ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 14.04 LTS tesseract 3.03.02-3ubuntu0.1~esm1 USN-8882-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tesseract +1 5.3.4-11.el10_2 RHSA-2026:98624, RHSA-2026:95085
RHEL 9 tesseract +1 4.1.1-11.el9_8 RHSA-2026:98514, RHSA-2026:95086
RHEL 8 tesseract +1 4.1.1-7.el8_10 RHSA-2026:95725
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 TUS tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.8 E4S tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.6 EUS Long Life tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239
RHEL 8.6 AUS tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tesseract +1 5.3.4-11.el10_2 ALSA-2026:95085
AlmaLinux 9 tesseract-devel 4.1.1-11.el9_8 ALSA-2026:95086
AlmaLinux 8 tesseract +1 4.1.1-7.el8_10 ALSA-2026:95725

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tesseract +1 5.3.4-11.el10_2 RLSA-2026:98624, RLSA-2026:95085
Rocky Linux 9 tesseract 4.1.1-11.el9_8 RLSA-2026:98514, RLSA-2026:95086
Rocky Linux 8 tesseract 4.1.1-7.el8_10 RLSA-2026:95725

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tesseract-ocr 5.5.3-2.1 openSUSE-SU-2026:11887-1
openSUSE Leap 16.0 tesseract-ocr 5.5.3-bp160.1.1 openSUSE-SU-2026:21957-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tesseract +1 5.3.4-11.el10_2 ELSA-2026-95085
Oracle Linux 9 tesseract +1 4.1.1-11.el9_8 ELSA-2026-95086
Oracle Linux 8 tesseract +1 4.1.1-7.el8_10 ELSA-2026-95725

Advisories 22

References