Skip to content
OpenAdvisories
High · 8.6 CVE-2026-88053 EUVD-2026-75630

Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata

Published Sep 10, 2026 · Updated Sep 11, 2026 · Assigned by GitHub_M

Vendor: tesseract-ocr Product: tesseract Package: tesseract Package: tesseract Ecosystem: Debian Ecosystem: Ubuntu

Description

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review.

Affected products

VendorProductAffectedFixed
tesseract-ocr tesseract <= 5.5.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tesseract No fix yet —
Debian 13 tesseract No fix yet —
Debian 12 tesseract No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tesseract No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS tesseract 5.5.0-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 24.04 LTS tesseract 5.3.4-1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 22.04 LTS tesseract 4.1.1-2.1ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 20.04 LTS tesseract 4.1.1-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 18.04 LTS tesseract 4.00~git2288-10f4998a-2ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 16.04 LTS tesseract 3.04.01-4ubuntu0.1~esm1 USN-8882-1
Ubuntu Pro 14.04 LTS tesseract 3.03.02-3ubuntu0.1~esm1 USN-8882-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 tesseract +1 5.3.4-11.el10_2 RHSA-2026:98624, RHSA-2026:95085
RHEL 9 tesseract +1 4.1.1-11.el9_8 RHSA-2026:98514, RHSA-2026:95086
RHEL 8 tesseract +1 4.1.1-7.el8_10 RHSA-2026:95725
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 TUS tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.8 E4S tesseract 4.1.1-2.el8_8.3 RHSA-2026:96238
RHEL 8.6 EUS Long Life tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239
RHEL 8.6 AUS tesseract 4.1.1-2.el8_6.3 RHSA-2026:96239

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tesseract +1 5.3.4-11.el10_2 ALSA-2026:95085
AlmaLinux 9 tesseract-devel 4.1.1-11.el9_8 ALSA-2026:95086
AlmaLinux 8 tesseract +1 4.1.1-7.el8_10 ALSA-2026:95725

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tesseract +1 5.3.4-11.el10_2 RLSA-2026:98624, RLSA-2026:95085
Rocky Linux 9 tesseract 4.1.1-11.el9_8 RLSA-2026:98514, RLSA-2026:95086
Rocky Linux 8 tesseract 4.1.1-7.el8_10 RLSA-2026:95725

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tesseract-ocr 5.5.3-2.1 openSUSE-SU-2026:11887-1
openSUSE Leap 16.0 tesseract-ocr 5.5.3-bp160.1.1 openSUSE-SU-2026:21957-1, openSUSE-RU-2026:22002-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 tesseract +1 5.3.4-11.el10_2 ELSA-2026-95085
Oracle Linux 9 tesseract +1 4.1.1-11.el9_8 ELSA-2026-95086
Oracle Linux 8 tesseract +1 4.1.1-7.el8_10 ELSA-2026-95725

Advisories 23

References