CVE-2026-88048

Tesseract OCR 5.5.3 and earlier contains a heap out-of-bounds write and read in FullyConnected::DeSerialize (src/lstm/fullyconnected.cpp), which fails to validate the ni_ and no_ layer scalars read from a .traineddata file against the dimensions of the stored weight matrix. When a crafted NT_SOFTMAX layer is loaded and run through the default LSTM engine, MatrixDotVector (src/lstm/weightmatrix.cpp) writes w.dim1() results into a buffer sized from no_ and reads w.dim2()-1 inputs from a buffer sized from ni_, so inconsistent dimensions corrupt adjacent heap memory. An attacker who can get a malicious .traineddata file loaded — for example a user or automated pipeline ingesting model files from an untrusted source — gains heap corruption and a crash (denial of service), and potentially information disclosure or controlled corruption. Any deployment of Tesseract 5.5.3 or earlier is affected, including the many applications, wrappers, and document-processing pipelines that embed the engine. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported, and no fixed release was available at the time of this review.

What to do: Until a patched release is published, only load .traineddata model files from trusted sources (distribution packages or official tessdata repositories) and avoid processing user-supplied model files through Tesseract. Monitor the Tesseract GitHub repository and upgrade to the first release containing the fix as soon as it becomes available. Packagers and vendors embedding the engine should plan to rebuild against the patched version once it ships.