CVE-2026-88051

Tesseract OCR 5.5.3 and earlier contain a heap out-of-bounds write (CWE-787) in the callback form of GenericVector::read (src/ccutil/genericvector.h), which reads the int32 fields reserved and size_used_ from a .traineddata model without a cap or invariant check, so reserve() allocates only reserved slots while the read loop writes size_used_ elements. The flaw is triggered when fontinfo_table_.read(fp, read_info) in src/classify/intproto.cpp loads an INTTEMP component whose version_id is 4 or later, meaning an attacker who can supply or tamper with a traineddata model file causes Tesseract to write FontInfo structures past the end of the heap buffer. An attacker gains heap corruption that can crash the OCR process (denial of service) and potentially achieve controlled corruption of adjacent heap memory. Anyone running Tesseract OCR 5.5.3 or earlier that processes untrusted .traineddata files is affected, including users of the command-line tool, library embedders, and common language wrappers. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and no fixed release is available as of this review.

What to do: No fixed release exists yet, so inventory for Tesseract 5.5.3 or earlier (including embedded uses via CLI, libraries, and wrappers such as Python integrations) and monitor the tesseract-ocr project for a patched version, upgrading as soon as one is published. Until then, only load .traineddata models from trusted sources and avoid running OCR on attacker-supplied or unverified model files, since a crafted INTTEMP component with version_id 4 or later is the trigger.